daf53cb484
* Introducing active hunters: - FootholdViaSecureKubeletPort - MaliciousIntentViaSecureKubeletPort * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Testing Update code according to expected testing standards and implementation. * Update documentation. - Added some more mitigations and updated the references list. * f-string is missing placeholders. - flake8 is marking this line as an issue as it lacks a placeholder when indicating the use of f-string; corrected. * Update kubelet.py - Add network_timeout parameter into requests.post and requests.get execution. * Update kubelet.py - Modified name of variable. * Update kubelet.py and test_kubelet.py - Remove certificate authority. * Update kubelet.py and test_kubelet.py. - Introducing default number of rm attempts. * Update kubelet.py and test_kubelet.py. - Introduced number of rmdir and umount attempts. * Update kubelet.py - Modified filename to match kube-hunter description. * Update several files. - Instated the use of self.event.session for GET and POST requests. - Testing modified accordingly to complete coverage of changes and introduced methods. - Requirements changed such that the required version that supports sessions mocking is obtained. * Update kubelet.py - Introduced warnings for the following commands in case of failure: rm, rmdir, and umount. * Update kubelet.py - Remove "self.__class__.__name___" from self.event.evidence. * Update kubelet.py - Remove unnecessary message section. * Update files. - Address class change. - Fix testing failure after removing message section. * Update kubelet.py - Provide POD and CONTAINER as part of the warning messages in the log. Co-authored-by: Abdullah Garcia <abdullah.garcia@jpmorgan.com> Co-authored-by: Yehuda Chikvashvili <yehudaac1@gmail.com> Co-authored-by: danielsagi <danielsagi2009@gmail.com>
2.5 KiB
vid, title, categories
| vid | title | categories | |
|---|---|---|---|
| KHV051 | Exposed Existing Privileged Containers Via Secure Kubelet Port |
|
{{ page.vid }} - {{ page.title }}
Issue description
The kubelet is configured to allow anonymous (unauthenticated) requests to its HTTPs API. This may expose certain information and capabilities to an attacker with access to the kubelet API.
A privileged container is given access to all devices on the host and can work at the kernel level. It is declared using the Pod.spec.containers[].securityContext.privileged attribute. This may be useful for infrastructure containers that perform setup work on the host, but is a dangerous attack vector.
Furthermore, if the kubelet and the API server authentication mechanisms are (mis)configured such that anonymous requests can execute commands via the API within the containers (specifically privileged ones), a malicious actor can leverage such capabilities to do way more damage in the cluster than expected: e.g. start/modify process on host.
Remediation
Ensure kubelet is protected using --anonymous-auth=false kubelet flag. Allow only legitimate users using --client-ca-file or --authentication-token-webhook kubelet flags. This is usually done by the installer or cloud provider.
Minimize the use of privileged containers.
Use Pod Security Policies to enforce using privileged: false policy.
Review the RBAC permissions to Kubernetes API server for the anonymous and default service account, including bindings.
Ensure node(s) runs active filesystem monitoring.
Set --insecure-port=0 and remove --insecure-bind-address=0.0.0.0 in the Kubernetes API server config.
Remove AlwaysAllow from --authorization-mode in the Kubernetes API server config. Alternatively, set --anonymous-auth=false in the Kubernetes API server config; this will depend on the API server version running.
References
- Kubelet authentication/authorization
- Privileged mode for pod containers
- Pod Security Policies - Privileged
- Using RBAC Authorization
- [KHV005 - Access to Kubernetes API]({{ site.baseurl }}{% link _kb/KHV005.md %})
- [KHV036 - Anonymous Authentication]({{ site.baseurl }}{% link _kb/KHV036.md %})