Don't want your Kubernetes Windows nodes hijacked? Patch this hole now

A now-fixed command-injection bug in Kubernetes can be exploited by a remote attacker to gain code execution with SYSTEM privileges on all Windows endpoints in a cluster, and thus fully take over those systems, according to Akamai researcher Tomer Peled.

Peled found the vulnerability, tracked as CVE-2024-9042, while conducting research for a presentation at last year's DEF CON infosec event about another Kubernetes-related flaw involving command injection in the open source container platform's sidecar project git-sync.

The latest vulnerability received a medium-severity score of 5.9 out of 10, and it affects Kubernetes versions earlier than 1.32.1 with beta features enabled.

Additionally, to exploit CVE-2024-9042, the Kubernetes cluster must not only be running Windows endpoints – the flaw doesn't affect any other OSes – it must be configured to run Log Query. This is a new, beta-level mechanism for pulling up the system status of remote machines using a command-line interface or a web API via a tool like Curl.

As Peled explained:

The vulnerability allows an attacker who has the ability to send such a query to a node to inject commands into that system with high privileges via a pattern parameter in the request. Log Query does not sufficiently validate and sanitize that parameter, which if carefully formatted will be executed on that Windows node.

Peled, who has shared a proof-of-concept exploit in the form of a Curl invocation and provided advice and further details here, suggests prioritizing patching this bug.

According to the Kubernetes project's security advisory, which lists off the versions you need to update to, users can detect whether this vulnerability has been exploited by examining their cluster's audit logs and searching for logs queries with suspicious inputs.

Who exactly is really at risk of attack, however, is called into question by Peled's analysis. There's unlikely to be many deployments running Windows Kubernetes nodes with beta logging features turned on, so this bug is more interesting as a lesson in secure coding than terrifying.

He does stress that the flaw only affects Kubernetes Windows nodes running beta management software. But then adds: "Since the issue lies within the source code, this threat will remain active and exploitation of it will likely increase — this is why we strongly advise patching your cluster even if it doesn't have any Windows nodes."

Peled told The Register Akamai had not seen any indication of active exploitation. He also explained his statement about expecting exploitation to increase thus:

"Even though there were several steps to make the exploit work, the payload does not require a lot of technical knowledge to create," he said. "We expect exploitation to increase because of the ease of creating the payload, it being common knowledge with the disclosure, and the severity of the impact to companies who use this feature."

• Windows Themes zero-day bug exposes users to NTLM credential theft
• Critical default credential in Kubernetes Image Builder allows SSH root access
• Patch now: Critical Nvidia bug allows container escape, complete host takeover
• Patch now: Cisco fixes critical 9.9-rated, make-me-admin bug

Kubernetes, for its part, has marked the flaw as fixed, and a project maintainer stressed to The Register it's really limited to Windows nodes and no longer an active threat.

"CVE-2024-9042 only affects builds of Kubernetes for Windows OS," the K8s bod said. "The vulnerable logic was not compiled into builds of Kubernetes used in Linux for affected versions, and Linux hosts running Kubernetes are unaffected." ®