services / Azure / Kubernetes user impersonation (AKS fleet member)

The Kubernetes impersonation capability for user identities on a member cluster of an AKS fleet. The impersonate verb on users lets a caller issue API requests as an arbitrary other user identity.

Impersonation lets an attacker act as any identity (including cluster-admins), so it is a direct path to full cluster compromise, hence CRITICAL.

Microsoft.​ContainerService/​fleets/​members/​users/​impersonate/​action

Impersonating a user lets an attacker act as any other identity, assuming its (potentially cluster-admin) privileges for both lateral movement and privilege escalation.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links