mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-23 22:26:23 +00:00
daf53cb484
* Introducing active hunters: - FootholdViaSecureKubeletPort - MaliciousIntentViaSecureKubeletPort * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Format Updating code according to expected linting format. * Testing Update code according to expected testing standards and implementation. * Update documentation. - Added some more mitigations and updated the references list. * f-string is missing placeholders. - flake8 is marking this line as an issue as it lacks a placeholder when indicating the use of f-string; corrected. * Update kubelet.py - Add network_timeout parameter into requests.post and requests.get execution. * Update kubelet.py - Modified name of variable. * Update kubelet.py and test_kubelet.py - Remove certificate authority. * Update kubelet.py and test_kubelet.py. - Introducing default number of rm attempts. * Update kubelet.py and test_kubelet.py. - Introduced number of rmdir and umount attempts. * Update kubelet.py - Modified filename to match kube-hunter description. * Update several files. - Instated the use of self.event.session for GET and POST requests. - Testing modified accordingly to complete coverage of changes and introduced methods. - Requirements changed such that the required version that supports sessions mocking is obtained. * Update kubelet.py - Introduced warnings for the following commands in case of failure: rm, rmdir, and umount. * Update kubelet.py - Remove "self.__class__.__name___" from self.event.evidence. * Update kubelet.py - Remove unnecessary message section. * Update files. - Address class change. - Fix testing failure after removing message section. * Update kubelet.py - Provide POD and CONTAINER as part of the warning messages in the log. Co-authored-by: Abdullah Garcia <abdullah.garcia@jpmorgan.com> Co-authored-by: Yehuda Chikvashvili <yehudaac1@gmail.com> Co-authored-by: danielsagi <danielsagi2009@gmail.com>
41 lines
2.5 KiB
Markdown
41 lines
2.5 KiB
Markdown
---
|
|
vid: KHV051
|
|
title: Exposed Existing Privileged Containers Via Secure Kubelet Port
|
|
categories: [Access Risk]
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
The kubelet is configured to allow anonymous (unauthenticated) requests to its HTTPs API. This may expose certain information and capabilities to an attacker with access to the kubelet API.
|
|
|
|
A privileged container is given access to all devices on the host and can work at the kernel level. It is declared using the `Pod.spec.containers[].securityContext.privileged` attribute. This may be useful for infrastructure containers that perform setup work on the host, but is a dangerous attack vector.
|
|
|
|
Furthermore, if the kubelet **and** the API server authentication mechanisms are (mis)configured such that anonymous requests can execute commands via the API within the containers (specifically privileged ones), a malicious actor can leverage such capabilities to do way more damage in the cluster than expected: e.g. start/modify process on host.
|
|
|
|
## Remediation
|
|
|
|
Ensure kubelet is protected using `--anonymous-auth=false` kubelet flag. Allow only legitimate users using `--client-ca-file` or `--authentication-token-webhook` kubelet flags. This is usually done by the installer or cloud provider.
|
|
|
|
Minimize the use of privileged containers.
|
|
|
|
Use Pod Security Policies to enforce using `privileged: false` policy.
|
|
|
|
Review the RBAC permissions to Kubernetes API server for the anonymous and default service account, including bindings.
|
|
|
|
Ensure node(s) runs active filesystem monitoring.
|
|
|
|
Set `--insecure-port=0` and remove `--insecure-bind-address=0.0.0.0` in the Kubernetes API server config.
|
|
|
|
Remove `AlwaysAllow` from `--authorization-mode` in the Kubernetes API server config. Alternatively, set `--anonymous-auth=false` in the Kubernetes API server config; this will depend on the API server version running.
|
|
|
|
## References
|
|
|
|
- [Kubelet authentication/authorization](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/)
|
|
- [Privileged mode for pod containers](https://kubernetes.io/docs/concepts/workloads/pods/pod/#privileged-mode-for-pod-containers)
|
|
- [Pod Security Policies - Privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)
|
|
- [Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
|
|
- [KHV005 - Access to Kubernetes API]({{ site.baseurl }}{% link _kb/KHV005.md %})
|
|
- [KHV036 - Anonymous Authentication]({{ site.baseurl }}{% link _kb/KHV036.md %})
|