mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-23 22:26:23 +00:00
21 lines
875 B
Markdown
21 lines
875 B
Markdown
---
|
|
vid: KHV003
|
|
title: Azure Metadata Exposure
|
|
categories: [Information Disclosure]
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
Microsoft Azure provides an internal HTTP endpoint that exposes information from the cloud platform to workloads running in a VM. The endpoint is accessible to every workload running in the VM. An attacker that is able to execute a pod in the cluster may be able to query the metadata service and discover additional information about the environment.
|
|
|
|
## Remediation
|
|
|
|
Consider using AAD Pod Identity. A Microsoft project that allows scoping the identity of workloads to Kubernetes Pods instead of VMs (instances).
|
|
|
|
## References
|
|
|
|
- [Azure Instance Metadata service](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service)
|
|
- [AAD Pod Identity](https://github.com/Azure/aad-pod-identity#demo)
|