Summary
A vulnerability in Azure Kubernetes Services allowed attackers to escalate privileges and access cluster credentials. Affected clusters used Azure CNI for network configuration and Azure for network policy. Attackers could exploit this issue to steal data and cause financial and reputational damage. The vulnerability has been fixed by Microsoft after disclosure by Mandiant.
Affected Services
Azure Kubernetes Services
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
-
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
Monitor for suspicious access to the WireServer (http://168.63.129.16) and HostGAPlugin endpoints. Implement NetworkPolicies to restrict access to these internal Azure services from within Kubernetes pods.
Piercing Index Rating
-
Discovered by
Nick McClendon, Daniel McNamara, Jacob Paullus, Mandiant
