services / Azure / Kubernetes user impersonation (Arc-connected cluster)

The Kubernetes impersonate verb on user identities for an Azure Arc-connected cluster. It allows the holder to make API requests acting as an arbitrary user identity (via the Impersonate-User header), assuming that user's RBAC permissions.

Impersonation is an identity-spoofing primitive: holding it on users/groups/userextras effectively grants the union of all identities' permissions, up to cluster-admin (system:masters). This is among the most powerful capabilities in a cluster.

Microsoft.​Kubernetes/​connectedClusters/​users/​impersonate/​action

User impersonation lets the holder act as any user including cluster-admin, a direct privilege-escalation and lateral-identity-takeover primitive.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links