A recently unearthed flaw in Kubernetes has sparked considerable alarm within the cybersecurity field. Researcher Tomer Peled from Akamai has pinpointed a design weakness in Kubernetes’ sidecar component, git-sync, which could potentially open doors for command injection attacks.
This issue impacts default Kubernetes setups across multiple platforms such as Amazon EKS, Azure AKS, and Google GKE. The flaw will be discussed in detail at DEF CON 2024.
The vulnerability is embedded in the git-sync project—a sidecar container designed to keep a Kubernetes pod in sync with a Git repository. While this tool is meant to automate updates, it inadvertently creates a substantial security risk due to insufficient input validation.
Attackers can exploit this flaw by introducing a malicious YAML file into the cluster—a process that requires minimal permissions—to execute arbitrary commands or extract data from the pod. Key parameters like GITSYNC_GIT and GITSYNC_PASSWORD_FILE are particularly exposed. The GITSYNC_GIT parameter can be misused to run a malicious binary, while the GITSYNC_PASSWORD_FILE can be manipulated to siphon off sensitive information, including access tokens.
The ramifications of this vulnerability are severe, potentially leading to unauthorized command execution and data breaches. Attackers with minimal access could deploy a malicious binary posing as git-sync to carry out commands under the pretense of legitimate activity, potentially bypassing security defenses and facilitating covert operations like cryptomining.
Additionally, those with editing privileges could redirect git-sync to transmit confidential files to an external server, jeopardizing the security of the entire Kubernetes cluster.
Despite the gravity of the issue, no CVE has been assigned and no official fix is available yet. The Kubernetes team has recognized the problem but views the necessary modifications as high-privilege actions that don’t require immediate action. Nonetheless, this research underscores the importance of heightened vigilance and oversight in Kubernetes environments.
“This attack vector poses a significant risk, particularly for organizations that have authorized git-sync communication within their clusters,” noted Tomer Peled.
To mitigate potential threats, organizations should bolster monitoring of outbound communications from Kubernetes pods, especially those involving git-sync. Regular inspections of git-sync pods are advisable to ensure compliance with expected command executions.
Furthermore, deploying Open Policy Agent (OPA) rules can assist in identifying and preventing unauthorized changes to git-sync configurations, thereby enhancing overall security.
