A critical vulnerability [3] [6], known as SysAll [1], has been discovered in Google Kubernetes Engine (GKE) [1] [3] [5] [6], affecting approximately 250,000 active GKE clusters [1]. This vulnerability stems from a misconfiguration in the systemauthenticated group [2], which includes any Google-authenticated account [1] [3] [6], even those outside the organization.
Description
Exploiting this vulnerability could grant external threat actors control over vulnerable GKE clusters, resulting in severe consequences such as lateral movement [6], cryptomining [1] [4] [6], denial-of-service attacks [6], and data theft [1] [4] [6]. Sensitive data [2] [3] [4] [5] [6], including JWT tokens, API keys [2] [3] [5] [6], and credentials [3] [5] [6], may be exposed. Google has taken steps to address the issue and advises users to refrain from binding the systemauthenticated group to any RBAC roles [6].
To address this vulnerability and other security risks, it is crucial to implement stringent security protocols in cloud environments and review cluster access controls [2]. The research also uncovered additional risks, such as the exposure of GCP API keys and service account JSONs [2], the discovery of private keys [2], unauthorized access to container registries [2], and the ability to access critical services like Grafana dashboards, RabbitMQ message brokers [2], and ElasticSearch clusters [2]. Upgrading to GKE version 1.28 or higher is recommended [2].
While no large-scale attacks exploiting this vulnerability have been reported, it is important for users to secure their clusters to prevent potential exploitation [3]. The Orca Platform can be utilized to identify overprivileged systemauthenticated groups and provide guidance on enhancing security measures. Additionally, a Threat Briefing will be held to discuss this GKE security loophole and provide recommendations for securing clusters [2].
Conclusion
In conclusion, the SysAll vulnerability in GKE poses significant risks, including unauthorized access and data exposure. By following the recommended security measures, users can mitigate these risks and protect their sensitive data. It is essential to stay vigilant and take proactive steps to secure GKE clusters, as well as to stay informed about future implications and developments in cloud security.
References
[1] https://flyytech.com/2024/01/24/google-kubernetes-misconfig-lets-any-gmail-account-control-your-clusters/
[2] https://orca.security/resources/blog/sys-all-google-kubernetes-engine-risk-example/
[3] https://thehackernews.com/2024/01/google-kubernetes-misconfig-lets-any.html
[4] https://orca.security/resources/blog/sys-all-google-kubernetes-engine-risk/
[5] https://www.jsplaces.com/cso-online/24/01/2024/group-permission-misconfiguration-exposes-google-kubernetes-engine-clusters/
[6] https://www.cyber-oracle.com/p/critical-google-kubernetes-engine
