services / Azure / Kubernetes userextra impersonation (AKS)

The Kubernetes userextra-impersonation capability on an AKS managed cluster, allowing the API caller to attach arbitrary extra authentication attributes to impersonated requests.

Extra attributes used in authorization decisions augment user/group impersonation, helping satisfy authorization rules to assume more-privileged identities.

Microsoft.​ContainerService/​managedClusters/​authentication.​k8s.​io/​userextras/​impersonate/​action

Impersonating userextras fields lets the attacker forge additional identity attributes used in authorization, augmenting impersonated identities to satisfy authz rules and escalate access.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links