CVE-2023-1260: Kubernetes Kube-apiserver Auth Bypass Flaw

CVE-2023-1260 Overview

An authentication bypass vulnerability was discovered in Kubernetes kube-apiserver that could allow authenticated attackers to evade Security Context Constraints (SCC) admission restrictions. This issue affects users who have been granted permissions to "update" or "patch" the pods/ephemeralcontainers subresource beyond the default configuration. By exploiting this flaw, an attacker could create a new pod or patch an existing pod they have access to, potentially gaining control of a privileged pod and bypassing intended security boundaries.

Critical Impact

Authenticated attackers with specific pod permissions can bypass SCC admission restrictions, potentially escalating to privileged container access and compromising the Kubernetes cluster security posture.

Affected Products

• Kubernetes kube-apiserver (all vulnerable versions)
• Red Hat OpenShift Container Platform 4.10
• Red Hat OpenShift Container Platform 4.11
• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13

Discovery Timeline

• September 24, 2023 - CVE-2023-1260 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-1260

Vulnerability Analysis

This authorization bypass vulnerability affects the Kubernetes kube-apiserver component, specifically in how it handles permissions for the pods/ephemeralcontainers subresource. Ephemeral containers are a Kubernetes feature designed for debugging purposes, allowing administrators to add temporary containers to running pods for troubleshooting.

The vulnerability arises when users are granted overly permissive access to update or patch ephemeral containers. Under normal circumstances, Kubernetes Security Context Constraints (SCC) or Pod Security Policies should prevent unauthorized privilege escalation. However, this flaw allows authenticated attackers to bypass these admission controls when manipulating ephemeral containers.

The attack requires the adversary to already have authenticated access to the Kubernetes cluster with specific permissions on the pods/ephemeralcontainers subresource. While this limits the attack surface to authenticated users with elevated permissions, successful exploitation can lead to complete compromise of the affected pod's security context, potentially allowing container escape or access to sensitive cluster resources.

Root Cause

The root cause lies in improper enforcement of Security Context Constraints (SCC) admission restrictions when processing requests to create or modify ephemeral containers. The kube-apiserver fails to properly validate that ephemeral container specifications comply with the same security constraints applied to regular containers within the pod. This allows an attacker to inject an ephemeral container with elevated privileges that would normally be denied by admission controllers.

Attack Vector

The attack is executed over the network by an authenticated user who has been granted update or patch permissions on the pods/ephemeralcontainers subresource. The attacker can leverage these permissions to:

1. Identify a target pod they have access to modify
2. Craft a malicious ephemeral container specification with elevated privileges
3. Patch the target pod to add the ephemeral container, bypassing SCC validation
4. Execute commands within the privileged ephemeral container

The attacker can also create a new pod with malicious ephemeral container specifications if they have pod creation permissions. This allows evasion of the intended security restrictions that would normally prevent such privileged access.

Detection Methods for CVE-2023-1260

Indicators of Compromise

• Unusual ephemeral container creation or modification events in Kubernetes audit logs
• Ephemeral containers running with elevated privileges or security contexts that violate cluster policies
• Unexpected PATCH or UPDATE requests to the pods/ephemeralcontainers subresource
• Users or service accounts accessing pods outside their normal operational scope

Detection Strategies

• Enable and monitor Kubernetes audit logging for all requests to the pods/ephemeralcontainers subresource
• Implement admission controller policies to detect and alert on ephemeral containers with suspicious security contexts
• Use SentinelOne Singularity Cloud Workload Protection to monitor for anomalous container behavior and privilege escalation attempts
• Deploy policy enforcement tools such as OPA Gatekeeper or Kyverno to validate ephemeral container specifications

Monitoring Recommendations

• Continuously audit RBAC configurations to identify users with excessive permissions on pods/ephemeralcontainers
• Set up alerts for ephemeral container creation events, particularly those with privileged security contexts
• Monitor for pods running with elevated capabilities or host namespace access that were not expected
• Review Kubernetes API server logs for patterns indicating reconnaissance or exploitation attempts

How to Mitigate CVE-2023-1260

Immediate Actions Required

• Review and restrict RBAC permissions for the pods/ephemeralcontainers subresource to only trusted administrators
• Apply the latest security patches from Red Hat OpenShift or Kubernetes upstream releases
• Audit existing ephemeral containers in your cluster for unauthorized privilege escalation
• Implement network policies to limit pod-to-pod communication where appropriate

Patch Information

Multiple vendors have released security patches addressing this vulnerability. Red Hat has published several security advisories with patched versions for OpenShift Container Platform:

• Red Hat Security Advisory RHSA-2023:3976
• Red Hat Security Advisory RHSA-2023:4093
• Red Hat Security Advisory RHSA-2023:4312
• Red Hat Security Advisory RHSA-2023:4898
• Red Hat Security Advisory RHSA-2023:5008

For detailed CVE information, refer to the Red Hat CVE-2023-1260 Description and the GitHub Security Advisory GHSA-92hx-3mh6-hc49.

Workarounds

• Remove or restrict update and patch permissions on the pods/ephemeralcontainers subresource for non-administrative users
• Implement strict Pod Security Standards (PSS) or Pod Security Policies to limit container privileges
• Use admission controllers to enforce security constraints on all container types including ephemeral containers
• Consider disabling ephemeral containers feature if not required in your environment

# Example: Audit RBAC permissions for ephemeralcontainers subresource
kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.kind=="ClusterRole") | select(.subjects != null) | {name: .metadata.name, subjects: .subjects}'

# Review ClusterRoles with ephemeralcontainers permissions
kubectl get clusterroles -o json | jq '.items[] | select(.rules != null) | select(.rules[].resources != null) | select(.rules[].resources[] | contains("ephemeralcontainers")) | {name: .metadata.name, rules: .rules}'