services / Azure / Kubernetes service account impersonation (AKS fleet member)

The Kubernetes impersonate verb on ServiceAccount identities for a member cluster of an AKS fleet, allowing a caller to issue API requests as an arbitrary ServiceAccount.

Impersonating a ServiceAccount yields that identity's RBAC permissions, enabling lateral movement and privilege escalation up to cluster-admin.

Microsoft.​ContainerService/​fleets/​members/​serviceaccounts/​impersonate/​action

Impersonating a ServiceAccount lets an attacker act as that in-cluster identity and inherit its (potentially broader) RBAC, the canonical lateral-movement and privilege-escalation primitive.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links