services / Azure / Kubernetes userextras impersonation (Fleet)

The Kubernetes userextras-impersonation privilege on an AKS Fleet, which allows a caller to forge extra identity attributes (userextras) attached to an impersonated request and used in authorization decisions.

Userextras impersonation completes the impersonation primitive by spoofing authorization-relevant identity claims, enabling assumption of higher-privileged identities.

Microsoft.​ContainerService/​fleets/​authentication.​k8s.​io/​userextras/​impersonate/​action

Impersonating userextras lets an attacker forge extra authentication claims used in authorization, enabling privilege escalation and assumption of another identity's access.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links