Saturday, June 22, 2024

Google Kubernetes Flaw Let Any Google User Control the Cluster

Researchers have discovered a new loophole in Google Kubernetes Engine (GKE), which threat actors can utilize with a Google account to take over the misconfigured Kubernetes Cluster. 

Threat actors can further use these compromised clusters for crypto mining, DoS (denial of service), and data theft. This loophole is dubbed “Sys:all” and affects more than 250,000 active GKE clusters, hundreds of them containing sensitive information.

This vulnerability exists due to the misconfiguration of RBAC bindings that result in system:authenticated groups having extreme privileges, potentially allowing any Google account holder to access and control vulnerable clusters.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Google Kubernetes Flaw

According to the reports shared with Cyber Security News, researchers conducted an internet-wide scan that identified thousands of clusters that could potentially be exploited, including some publicly traded companies.

Additionally, a Python script and a Google authentication token were used to interact with the Kubernetes API of these clusters.

Moreover, there were also attempts to map these clusters to their respective organizations, which could potentially reveal their owners and the impact that could be made.

Targeted Endpoints and Exploitation

Most of the targeted data points were configmaps, Kubernetes secrets, service account details, and other critical operational data, which could provide a significant amount of information for attacking an organization.

The results of exploiting the misconfigurations had many more implications, which included allowing list and pulling images from the container registries and open access to AWS credentials within a cluster’s configmap.

However, with these credentials, it was possible to access S3 buckets, which had several sensitive information and logs, which had admin credentials alongside several valuable endpoints such as RabbitMQ, Elastic, authentication server, and internal systems.

The most interesting part is that all of these endpoints could be accessed with administrator privilege.

RabbitMQ accessed with extracted credentials (Source: Orca Security)
RabbitMQ accessed with extracted credentials (Source: Orca Security)

Attack Flow

As of the initial access, the misconfigured GKE cluster allowed cluster-admin permissions to the system:authenticated group which enables querying multiple valuable resources using the Kubernetes API.

Inside the accessible resources, there were exposed AWS credentials (access key and secret key) within a bash script. This credential was further used to access S3 buckets for listing and downloading contents of multiple S3 buckets, some of which contained log files with operational data.

Exposed credentials (Source: Orca Security)
Exposed credentials (Source: Orca Security)

Following the examination of these logs, the researchers were able to find administrator credentials that can be used to log into various systems, including an internal platform.

Additionally, multiple important URLs to internal services such as ElasticSearch and RabbitMQ were also identified that could be accessed with superuser privileges.


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles