QID 91717

QID 91717: Test Only -Microsoft Azure Active Directory Pod Identity Spoofing Vulnerability - January 2021

The AAD pod identity enables users to assign identities to pods in Kubernetes clusters and fetch them from the pods using a regular IMDS (Azure Instance Metadata Service) request. When an identity is assigned to a pod, the pod can access the IMDS endpoint and get a token of that identity.

Affected Software:
Microsoft Azure Kubernetes Service

An attacker who successfully exploited this vulnerability can laterally steal the identities that are associated with different pods.

CVSS V3 rated as Medium - 5.5 severity.

CVSS V2 rated as Low - 2.1 severity.

Solution

Customers with existing installation need to re-deploy their cluster and use Azure CNI instead of the default kubernet.
For more information, please see details here:
Configure Azure CNI
AZURE ACTIVE DIRECTORY POD IDENTITY FOR KUBERNETES

Vendor References

Azure Active Directory Pod Identity - portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1677

CVEs related to QID 91717

CVE-2021-1677 |

Software Advisories

Advisory ID	Software	Component	Link
Azure Active Directory Pod Identity			portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1678

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].