Three security flaws were introduced by a single coding mistake in an AWS authentication component.
The flaw was found in the AWS Identity & Access Management (IAM) authenticator for Kubernetes, which was found by Gafnit Amiga of Lightspin.
Amiga stated in a post that she had discovered “a number of holes in the authentication process that might evade the defence against replay attacks or allow an attacker to get higher rights in the cluster by impersonating other identities.”
The flaw, designated CVE-2022-2385, is a parsing error; the offending line of code doesn’t check the capitalization of parameters provided to it.
Because of this, “an attacker can submit two separate variables with the same name but different uppercase and lowercase letters. As an illustration, “Action” and “action,” Amiga wrote.
The bug’s privilege escalation is its most detrimental effect.
Amiga stated that an attacker “may create a bad token in AWS IAM Authenticator that will modify the AccessKeyID value.”
The parameter that is given to a verified user is called AccessKeyID.
The AWS IAM Authenticator server will utilise this string in lieu of the placeholder “AccessKeyID” during the mapping if I enter any string I like.
For individuals setting up their own Kubernetes clusters, AWS said that the issue has been resolved in all of its cloud offerings as well as the related software.
“As of June 28, 2022, a new version of the AWS IAM Authenticator for Kubernetes has been installed on all EKS clusters globally, incorporating a patch for this problem, “According to the company’s advisory.
Customers who use Amazon EKS’s AWS IAM Authenticator for Kubernetes do not require any additional security measures.
Customers that host and operate their own Kubernetes clusters and who use the ‘AccessKeyID’ template parameter of the authenticator plugin need to update to version 0.59 of the AWS IAM Authenticator for Kubernetes.”