How One Kubernetes YAML Can Hand Over a GCP Organization
A design flaw in Google's Kubernetes Config Connector allows attackers with namespace access to take over an entire GCP organization using a single YAML file.
Security researcher Justin O'Leary discovered 'ConfigConfusion,' a critical design flaw in Google Kubernetes Config Connector (KCC). The vulnerability allows a user with access to a Kubernetes namespace watched by KCC to escalate privileges to the owner of the entire Google Cloud organization by creating a single IAMPolicyMember resource. This occurs because KCC uses a service account with broad permissions to execute actions on behalf of users without checking if the originating Kubernetes user should be authorized for the resulting cloud action, creating a 'confused deputy' scenario.
- A design flaw in Google's Config Connector (KCC) for Kubernetes can lead to full GCP organization takeover.
- The 'ConfigConfusion' attack uses a single Kubernetes YAML file to escalate privileges.
- Attackers with namespace access can grant themselves organization owner permissions.
- The issue stems from the 'confused deputy' problem between Kubernetes RBAC and GCP IAM.
- KCC's broad permissions act on instructions from less-privileged users without cross-system checks.
- ATT&CK
- T1078 Valid Accounts
- Vendors
- Victims
- Google Cloud customers
From the original article
7 min read at bleepingcomputer.com
A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to organization-wide privilege escalation. [...]
By Sponsored by Varonis · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.