Wiz Details Privilege-Escalation Risks in Managed Kubernetes Middleware

Jun 12, 2023 · Original article ↗

Summary

Wiz assesses managed Kubernetes middleware in AKS, EKS and GKE, finding risky host access and describing privilege-escalation paths through Node Problem Detector and Fluent Bit, alongside mitigations and gaps in standard controls.

Key points

The assessment found that 8 of 25 middleware components shared host namespaces, had privileged containers or added capabilities, or mounted sensitive host volumes.
Node Problem Detector can execute custom plugin scripts as root; an attacker able to write to its plugin directory could gain periodic host execution and access tokens belonging to pods on the node.
A poisoned Fluent Bit ConfigMap can use the EXEC plugin to run commands, exfiltrate service-account tokens, and support movement to other nodes.
The article says middleware permissions were not over-privileged, but that necessary operations can still require high privileges.
Pod Security Admission does not protect middleware in exempt namespaces, and 13 of 25 assessed components could not automatically migrate to user namespaces in their current configuration.
Suggested mitigations include running containers as non-root, placing configurable add-ons in more granular namespaces, and minimizing container images; host-level middleware remains difficult to cover with cluster controls.

Article Details

Attack Vectors: Write access to the Node Problem Detector (NPD) custom plugin directory can enable periodic execution of bash scripts with root privileges on the host.
An attacker with permission to update a Fluent Bit ConfigMap can poison its configuration and use the EXEC plugin for periodic command execution.
The article describes reaching the NPD plugin directory through a file-write vulnerability in a pod with a suitable volume mapping, a compromised registry image, or pod escape.
The Fluent Bit attack demo included pod enumeration, ConfigMap poisoning, service-account-token exfiltration to a C2 server, and pivoting to other nodes.
Defensive Notes: Run containers as non-root where possible to reduce the impact of container escape and limit the ability to write to sensitive locations such as the NPD custom plugin directory.
Where add-ons can be configured to run outside kube-system, use a separate namespace so admission-controller policies can be applied; the article notes that kube-system is exempt from Pod Security Admission in AKS and EKS.
Cloud service providers can reduce incident impact by minimizing managed middleware container images; the article gives the CoreDNS image lacking a bash execution context as an example.
Include control-plane and managed-cluster-middleware components in security-control coverage rather than excluding them by process name, image, or namespace.
For host-level middleware, the article suggests deploying components as DaemonSets or running them as CronJobs with controlled affinity.
Use visibility and configuration checks to identify principals that can update Fluent Bit or NPD ConfigMaps and pods with sensitive volume mappings that permit writes to the NPD custom plugin directory.
The article says user namespaces cannot automatically accommodate 52% of the assessed default v1.25 middleware components, and do not apply to host-level middleware.