search

uswitch / kiam

Integrate AWS IAM with Kubernetes
Apache License 2.0
1.15k stars 238 forks source link

Kiam security issue #516

Open iangcarroll opened 2 years ago

iangcarroll commented 2 years ago

Hello, I realize this repository is deprecated, so there may not be a way to report security issues at this point in time. However, I have discovered a way to bypass the Kiam agent and receive IAM credentials for the underlying Kubernetes node, as an unprivileged pod. This issue is in the Kiam agent and not in how traffic is forwarded to it.

Is there a security contact for this repository I could privately forward the issues along to? Otherwise, if this project isn't being maintained, I guess I will just disclose the issue details here as a heads up for those looking at/auditing Kiam.

gladiatr72 commented 2 years ago

Use the --iptables switch for the agent--not sure that it supports IPVS (if relevant)

iangcarroll commented 2 years ago

This issue isn't related to how traffic makes it to the Kiam node, so shouldn't matter how you steer traffic towards it. I am hesitant to post any more information here, so will let this issue sit for a bit.

gladiatr72 commented 2 years ago

Whatever. You've evidently got it covered, huh? You'll find that your problem is rooted in the server pod being redirected to the agent service when trying to connect to the metadata endpoint (due to those agent-installed iptables nat rules)

Good luck