kube-hunter/docs/_kb/KHV003.md

vid, title, categories

vid	title	categories
KHV003	Azure Metadata Exposure	Information Disclosure

{{ page.vid }} - {{ page.title }}

Issue description

Microsoft Azure provides an internal HTTP endpoint that exposes information from the cloud platform to workloads running in a VM. The endpoint is accessible to every workload running in the VM. An attacker that is able to execute a pod in the cluster may be able to query the metadata service and discover additional information about the environment.

Remediation

Consider using AAD Pod Identity. A Microsoft project that allows scoping the identity of workloads to Kubernetes Pods instead of VMs (instances).

References

• Azure Instance Metadata service
• AAD Pod Identity