UNIT 42’s investigation demonstrates a post-exploitation technique that could let an attacker with root access on a Kubernetes node misuse SPIFFE/SPIRE workload identities to impersonate co-located workloads and harvest SVIDs. The research shows that SPIFFE/SPIRE’s trust boundary rests on the assumption that the node itself is trusted; once an attacker controls a node, they can tamper with the attestation data used by the SPIRE agent, causing it to issue an identity to a malicious process.
The team built Spooffe, an open-source tool, to automate this process and enumerate workload identities by spoofing cgroup metadata, effectively extracting all SVIDs available on the host. The researchers emphasise that, in practice, root-level access equates to access to all cryptographic identities scoped to that node.
The attack hinges on the SPIRE workload attestation flow, where the agent gathers selectors from the calling process (via Kubernetes and Unix plugins, among others) and matches them against server-side registration entries. By manipulating the cgroup path, an attacker can fool the agent into attributing identities to a malicious process.
The article provides concrete demonstrations, including a pod registration entry and successful retrieval of the corresponding SVIDs and JWTs, and it documents the exact steps used to spoof a workload’s cgroup to obtain its identity. Recommended mitigations include hardening nodes, restricting root access, prohibiting privileged containers and host access, and minimising reliance on weak selectors.
The piece also notes that Palo Alto Networks customers benefit from Cortex XDR and XSIAM for multi-layer protection and Cortex Cloud Identity Threat Detection to monitor for identity abuse.