services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest (CSR) objects in an AKS managed cluster: requests to the cluster CA to sign an X.509 client/serving certificate. Approved CSRs carry the issued certificate in their status.certificate field, and the requested subject (username/groups) determines the identity the certificate authenticates as.

CSRs are a credential-issuance primitive; the certificate-issuance path is a well-known Kubernetes privilege-escalation vector that can mint cluster-admin (system:masters) credentials.

Microsoft.​ContainerService/​managedClusters/​certificates.​k8s.​io/​certificatesigningrequests/​write

Creating/updating a CSR (and the status/approval subresource) lets an attacker request a client certificate for an arbitrary username/group (e.g. system:masters) which, once signed, yields durable cluster-admin credentials — the canonical Kubernetes escalation path.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links