Businesses using containers to deploy their software often rely on the popular cloud container orchestration system Kubernetes but a recently discovered security flaw could allow anyone to gain access to their containers.
The privilege escalation flaw, which was discovered by Rancher Labs' chief architect and co-founder Darren Shepard, allows any user to establish a connection through Kubernetes' API server to a backend server.
Once the connection is established, an attacker can then send arbitrary requests over the network directly to the backend. These requests are even authenticated by Kubernetes API server's Transport Layer Security (TLS) credentials.
The flaw can even be exploited by both authenticated and unauthenticated users in default Kubernetes configurations which means anyone who knows about it could potentially take control of a business' Kubernetes cluster.
Time for an upgrade
In a blog post detailing the severity of the flaw, Red Hat explained how an attacker could exploit it for malicious purposes, saying:
“Kubernetes, like all software, is not immune to security issues - the privilege escalation flaw makes it possible for any user to gain full administrator privileges on any compute node being run in a Kubernetes cluster. This is a big deal. Not only can this actor steal sensitive data or inject malicious code, but they can also bring down production applications and services from within an organization’s firewall.”
Fortunately for Kubernetes users, there is a fix but securing your containers will require an upgrade.
Kubernetes v1.0x-v1.9x are vulnerable but v1.10.11, v1.11.5, v1.13.3 and v1.13.0-rc.1 have all been patched.
While upgrading can certainly be a hassle, now that the Kubernetes privilege escalation flaw has been made public, hackers will likely try to take advantage of companies that have not upgraded their software.
Via ZDNet
- We've also highlighted the best cloud orchestration software
