Google Kubernetes Flaw Let Any Google User Control the Cluster

Researchers have discovered a new loophole in Google Kubernetes Engine (GKE), which threat actors can utilize with a Google account to take over the misconfigured Kubernetes Cluster. 

Threat actors can further use these compromised clusters for crypto mining, DoS (denial of service), and data theft. This loophole is dubbed “Sys:all” and affects more than 250,000 active GKE clusters, hundreds of them containing sensitive information.

This vulnerability exists due to the misconfiguration of RBAC bindings that result in system:authenticated groups having extreme privileges, potentially allowing any Google account holder to access and control vulnerable clusters.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Run Free Threat Scan

Google Kubernetes Flaw

According to the reports shared with Cyber Security News, researchers conducted an internet-wide scan that identified thousands of clusters that could potentially be exploited, including some publicly traded companies.

Additionally, a Python script and a Google authentication token were used to interact with the Kubernetes API of these clusters.

Moreover, there were also attempts to map these clusters to their respective organizations, which could potentially reveal their owners and the impact that could be made.

Targeted Endpoints and Exploitation

Most of the targeted data points were configmaps, Kubernetes secrets, service account details, and other critical operational data, which could provide a significant amount of information for attacking an organization.

The results of exploiting the misconfigurations had many more implications, which included allowing list and pulling images from the container registries and open access to AWS credentials within a cluster’s configmap.

However, with these credentials, it was possible to access S3 buckets, which had several sensitive information and logs, which had admin credentials alongside several valuable endpoints such as RabbitMQ, Elastic, authentication server, and internal systems.

The most interesting part is that all of these endpoints could be accessed with administrator privilege.

Attack Flow

As of the initial access, the misconfigured GKE cluster allowed cluster-admin permissions to the system:authenticated group which enables querying multiple valuable resources using the Kubernetes API.

Inside the accessible resources, there were exposed AWS credentials (access key and secret key) within a bash script. This credential was further used to access S3 buckets for listing and downloading contents of multiple S3 buckets, some of which contained log files with operational data.

Following the examination of these logs, the researchers were able to find administrator credentials that can be used to log into various systems, including an internal platform.

Additionally, multiple important URLs to internal services such as ElasticSearch and RabbitMQ were also identified that could be accessed with superuser privileges.