A security researcher from Akamai, Tomer Peled, uncovered a significant flaw in Kubernetes. This vulnerability, identified as CVE-2023-5528 with a seriousness score of 7.2, could let hackers remotely control Windows servers in a Kubernetes environment, potentially taking over the entire Windows setup in the cluster.
The issue comes from how Kubernetes handles data sharing and storage across its system, specifically through something called volumes. Hackers can exploit this by setting up certain containers and storage units to gain administrator access to Windows servers.
What makes this vulnerability particularly troubling is its ease of exploitation. Attackers simply need to tweak a setting and apply three specific configuration files to take control of Windows servers. This process involves using YAML files, a common format for configuring Kubernetes.
The vulnerability affects Kubernetes versions before 1.28.4 and applies to setups using a certain type of storage plugin for Windows. It means a variety of scenarios could lead to attacks, given the numerous storage options available.
Peled stumbled upon this flaw while investigating another issue caused by insecure coding practices in Kubernetes, emphasizing the importance of checking and sanitizing user inputs in the system's code.
The Kubernetes team has been notified and has released a patch to fix the issue. Despite the fix, the discovery highlights a broader challenge with securing Kubernetes, which, due to its complexity and flexibility, presents numerous security challenges. Organizations are advised to keep their systems updated and follow best practices, such as using role-based access controls, to protect against such vulnerabilities.
If running older versions of Kubernetes with Windows nodes, administrators should apply the patch promptly. Even if Windows nodes aren't used, updating is recommended as a precaution. For those unable to patch immediately, Akamai suggests using an Open Policy Agent rule to help detect and block attempts to exploit this flaw.
DARKREADING.COM