Azure Kubernetes hit with TLS Bootstrap attack, researchers find

TLDR:

• Cybersecurity researchers have uncovered a TLS Bootstrap Attack on Azure Kubernetes Clusters, allowing for privilege escalation and access to credentials.
• The attack technique involves exploiting a security flaw in Microsoft Azure Kubernetes Services using Azure WireServer.

Researchers have disclosed a security flaw impacting Microsoft Azure Kubernetes Services that could allow an attacker to escalate their privileges and access credentials for services used by the cluster. The attack involves accessing Azure WireServer to extract TLS bootstrap tokens and gain access to sensitive information within the cluster. Microsoft has patched the issue following responsible disclosure. This discovery comes amidst other high-severity vulnerabilities in Kubernetes, highlighting the importance of ongoing security assessments and defenses.

Article:

Cybersecurity researchers have recently revealed a security flaw in Microsoft Azure Kubernetes Services that could potentially lead to privilege escalation and unauthorized access to credentials used by the cluster. This vulnerability, known as the TLS Bootstrap Attack, allows attackers to exploit the Azure WireServer component to retrieve TLS bootstrap tokens and decrypt sensitive information within the cluster. By downloading the configuration used to provision the cluster node, threat actors can perform a TLS bootstrap attack and access secrets such as KUBELET_CLIENT_CONTENT, KUBELET_CLIENT_CERT_CONTENT, and KUBELET_CA_CRT. While Microsoft has addressed the issue, it underscores the importance of ongoing security assessments and defenses in Kubernetes environments.