In recent developments, cybersecurity experts have raised alarms over a high-severity vulnerability identified in Kubernetes, marked as CVE-2023-5528. This critical flaw has the potential to allow attackers to execute arbitrary code with system privileges across all Windows endpoints within a cluster. Akamai, a leading global content delivery network, cybersecurity, and cloud service company, has issued a warning regarding the severity of this vulnerability and its implications for organizations utilizing Kubernetes on Windows platforms.
Understanding CVE-2023-5528
Akamai’s security researcher, Tomer Peled, has uncovered a critical vulnerability in Kubernetes, designated as CVE-2023-5528, with a CVSS score of 7.2. This vulnerability is particularly alarming as it allows for remote code execution with SYSTEM privileges across all Windows endpoints within a Kubernetes cluster. The exploitation mechanism involves the application of malicious YAML files to the cluster, posing a severe security threat that could lead to a full takeover of all Windows nodes in the affected cluster.
CVE-2023-5528 can be exploited in default installations of Kubernetes versions earlier than 1.28.4. This vulnerability has been verified against both on-premises deployments and Azure Kubernetes Service (AKS). The blog post provides a proof-of-concept YAML file and an Open Policy Agent (OPA) rule to help block this vulnerability, emphasizing the critical nature of this security flaw.
Technical Details and Proof of Concept of CVE-2023-5528
The vulnerability CVE-2023-5528, discovered by Akamai security researcher Tomer Peled, is a high-severity flaw in Kubernetes with a CVSS score of 7.2. It allows for remote code execution with SYSTEM privileges on all Windows endpoints within a Kubernetes cluster. This section delves into the technical specifics and provides a proof of concept to understand the vulnerability’s exploitation mechanism.
Vulnerability Origin
The root cause of CVE-2023-5528 lies in the insecure handling of the subPath parameter in YAML files that create pods with volumes in Kubernetes. This lack of user input sanitization opens the door for command injection vulnerabilities. The specific focus for CVE-2023-5528 is on Kubernetes clusters running on Windows nodes, where the exploitation of this vulnerability can lead to full control over all Windows nodes in a cluster.
Kubernetes Volumes and PersistentVolumes
Kubernetes volumes support the sharing of data between pods or storing it persistently outside of a pod’s lifecycle. Local volumes and hostPath volumes are two types that are relevant to this vulnerability. Local volumes allow users to mount disk partitions inside a pod, while hostPath volumes enable the mounting of directories from the node into a pod.
The exploitation process involves creating a pod that includes a local volume. During this process, the kubelet service eventually calls the MountSensitive() function, which includes a command line call to exec.command. This call creates a symlink between the volume’s location on the node and inside the pod. By manipulating this process, an attacker can inject malicious commands.
Proof of Concept
The proof of concept involves manipulating the local.path parameter inside the persistentVolume YAML file to include a malicious command. This command is then executed during the volume mounting process. For demonstration purposes, a benign command like &calc.exe&& is used, which opens a calculator on the node. However, this method can be adapted to execute more malicious commands.
When this YAML file is applied to the cluster, the malicious command is executed, demonstrating the vulnerability’s potential for exploitation.
Mitigation and Patch Analysis
The Kubernetes team addressed this vulnerability by replacing the vulnerable command line call in the MountSensitive() function with a native Go function, os.Symlink(), which securely performs the symlink operation without the possibility of command injection.
To determine vulnerability, administrators can check their Kubernetes version and the presence of Windows nodes in their cluster. The vulnerability affects default installations of Kubernetes earlier than version 1.28.4.
CVE-2023-5528 highlights the critical importance of input sanitization in Kubernetes and the potential for severe security implications when vulnerabilities are exploited. By understanding the technical details and proof of concept, administrators and security professionals can better assess their systems’ vulnerability and apply necessary patches and mitigations to protect their Kubernetes clusters.
Broader Implications for Kubernetes Security
The discovery of CVE-2023-5528 highlights the ongoing security challenges facing Kubernetes environments. As organizations increasingly adopt containerization and Kubernetes for their operational needs, the security of these systems becomes paramount. This incident serves as a reminder of the importance of maintaining rigorous security practices, staying informed about emerging vulnerabilities, and promptly addressing identified threats.
The exploitation of the high-severity Kubernetes vulnerability CVE-2023-5528 poses a significant threat to organizations using Kubernetes on Windows platforms. The potential for arbitrary code execution with system privileges underscores the need for immediate and comprehensive security measures. By following the recommendations provided by cybersecurity experts and entities like Akamai, organizations can mitigate the risks associated with this vulnerability and safeguard their Kubernetes environments against potential threats. As the cybersecurity landscape continues to evolve, staying vigilant and proactive in addressing vulnerabilities will be key to maintaining the security and integrity of critical systems.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.
