services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects in an AKS fleet, which request and (once approved/signed) carry issued client certificates used to authenticate identities to the cluster API.

CSRs are PKI/credential material: an approved CSR's status field contains a signed client certificate usable to authenticate as an arbitrary subject, including cluster-admin groups.

Microsoft.​ContainerService/​fleets/​certificates.​k8s.​io/​certificatesigningrequests/​write

Creating/updating CSRs (including the approval/status subresources implied by write) lets an attacker request and mint client certificates for arbitrary usernames/groups such as system:masters, forging cluster-admin identities for privilege escalation and durable credential-based persistence.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links