Kubernetes Vulnerability: Command Injection Attacks Threaten the Security of Your Clusters

A recently discovered vulnerability in Kubernetes has raised serious concerns in the cybersecurity community. Akamai researcher Tomer Peled found a flaw in the Kubernetes project called git-sync, which allows attackers to execute command injection attacks.

This vulnerability affects standard Kubernetes installations on various platforms such as Amazon EKS, Azure AKS, and Google GKE. It will be presented at the DEF CON 2024 conference.

The vulnerability is related to the git-sync project, which is used to synchronize a Kubernetes container with a Git repository. This synchronization process, intended for automatic updates, inadvertently opens a broad attack surface due to insufficient input validation.

Attackers can exploit this vulnerability by applying a malicious YAML file to the cluster, a low-privileged operation. This allows them to execute arbitrary commands or steal data from the container.

How to Protect Against This Threat

Two critical parameters, GITSYNC_GIT and GITSYNC_PASSWORD_FILE, are particularly vulnerable. GITSYNC_GIT allows specifying a command to be executed, which can be replaced with a malicious executable for code execution. GITSYNC_PASSWORD_FILE can be manipulated to extract sensitive information, such as access tokens, from the container.

This vulnerability could lead to severe consequences, such as unauthorized command execution and data theft. Attackers with minimal privileges can deploy an executable inside the container disguised as git-sync and execute commands under the guise of legitimate operations, bypassing security measures.

Moreover, attackers with editing rights can redirect git-sync to send sensitive files to an external server, potentially compromising the entire Kubernetes cluster.

Despite the severity of the vulnerability, it has not received a CVE identifier, and no official patch has been released. The Kubernetes team has acknowledged the issue but considers editing operations to be highly privileged, so they do not see an immediate need to release a fix. However, the research highlights the need for increased awareness and monitoring of the Kubernetes environment.

To mitigate risks, organizations are advised to strengthen monitoring of outgoing communications from Kubernetes containers, especially those using git-sync. Regular audits of git-sync containers are recommended to ensure they are executing expected commands.

Additionally, implementing Open Policy Agent (OPA) rules can help detect and block potential attack vectors by identifying unauthorized changes in git-sync configurations.

The detection of Cyclops underscores the ongoing threat from groups like Charming Kitten. The development of this malware and the use of the Go language indicate an increase in the attackers' skill levels. Cybersecurity experts hope that by sharing this information, they can improve detection and protection methods to prevent the spread of Cyclops and protect potential targets from future attacks.