Summary:
A high-severity vulnerability, CVE-2023-5528, with a CVSS score of 7.2, has been discovered by Akamai security researcher Tomer Peled in Kubernetes. This vulnerability allows remote code execution with SYSTEM privileges on all Windows endpoints within a Kubernetes cluster, posing a significant threat. It can be exploited via malicious YAML files, potentially leading to full takeover of Windows nodes. Default installations of Kubernetes before version 1.28.4 are vulnerable, affecting both on-prem deployments and Azure Kubernetes Service. A proof-of-concept YAML file and an Open Policy Agent (OPA) rule for blocking this vulnerability are provided in this blog post.

The discovery of CVE-2023-5528 highlights the critical importance of continuous scrutiny of Kubernetes configurations. Exploitation of this vulnerability underscores the need for stringent input sanitization measures within Kubernetes and its related projects. While the Kubernetes team's swift patching response is commendable, organizations must prioritize patching to versions later than 1.28.3 to mitigate this vulnerability. Additionally, the provided OPA rule offers a proactive measure to detect and block malicious behavior, offering interim protection for organizations unable to immediately patch.

Security Officer Comments:
The rise in command injection vulnerabilities within Kubernetes emphasizes the need for heightened vigilance and monitoring of YAML file contents. The provided OPA rule serves as a valuable tool in enhancing security efforts, but organizations should remain vigilant for emerging threats and adhere to best practices for Kubernetes security. Continued monitoring and collaboration within the security community are essential for staying ahead of evolving threats.

Suggested Corrections:
The primary mitigation strategy for CVE-2023-5528 is patching Kubernetes to a version later than 1.28.3. However, organizations unable to patch immediately can deploy the provided OPA rule to detect and block malicious behavior. It's crucial to prioritize patching efforts, especially for environments with Windows nodes within the Kubernetes cluster. This vulnerability exclusively affects Windows nodes, organizations without Windows nodes can delay patching but should still address it promptly when feasible. Continuous monitoring of Kubernetes configurations and proactive measures such as the provided OPA rule are essential in mitigating the risk posed by vulnerabilities in Kubernetes and ensuring robust security posture.

Link(s):
https://www.akamai.com/blog/securit...injection-vulnerability-rce-system-privileges