Kaspersky researchers breach cloud tenant isolation in test

Kaspersky researchers say a penetration test of an anonymised major cloud provider showed how weaknesses in its infrastructure could let a tenant cross isolation boundaries and reach other customers’ services. Starting with an ordinary tenant account, they created a privileged pod in a managed Kubernetes cluster running `v1.25.16+k0s.0`, gaining root access to a worker node.

A token found there let them exploit Konnectivity, the service linking Kubernetes control-plane and worker nodes, to make network connections from the control plane and run code on it. Mirantis, which develops k0s, confirmed the Konnectivity vulnerability. The researchers then used an OverlayFS privilege-escalation flaw on Ubuntu 22.04 with kernel 5.15.x to obtain root access.

That access exposed a flat overlay network containing managed services. Kaspersky says the researchers found other tenants’ host details and private SSH keys in VictoriaMetrics and VictoriaLogs, and used a key to access their cluster nodes.

They also demonstrated routes to compromise managed Kafka, Redis, PostgreSQL and MySQL services, including exposed Java RMI, a redis-exporter flaw that leaked connection credentials, unrestricted access to etcd configuration, and weaknesses in database configuration and privilege handling. A separate flaw in a custom SaltStack script enabled SQL injection; database access revealed authentication tokens that could have allowed commands to be run across cloud minions.

Kaspersky says the research was conducted under a bug bounty programme, the provider was notified and all identified issues were fixed. The researchers did not pursue the SaltStack attack further after agreeing this with the vendor. The provider was advised to strengthen network isolation, use stricter AppArmor policies and monitor potentially vulnerable services.