services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects (certificates.k8s.io) used to request and issue X.509 client/serving certificates that authenticate identities to the cluster API server.

An approved CSR's status.certificate field contains a signed client certificate that is a usable cluster credential; CSRs are a well-known Kubernetes privilege-escalation and credential-minting vector, making this a CRITICAL identity/credential asset.

Microsoft.​ContainerService/​aiManagers/​certificates.​k8s.​io/​certificatesigningrequests/​write

Creating CSRs lets an attacker request a client certificate bound to an arbitrary username/group (e.g. system:masters / cluster-admin); once signed it mints a durable credential for a higher-privileged identity.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links