⬇ Download holy card: ·
Blessed WireServing, Who Queried Azure's Wire
Patron of Kubernetes clusters on Azure, internal metadata, and pods that chat with the wrong endpoints.
Life
On 19 August 2024 Mandiant described a privilege escalation in AKS clusters configured with Azure CNI networking. From an ordinary pod, without being root, one could query WireServer and HostGAPlugin, undocumented internal Azure endpoints, to recover the node's provisioning script. Inside were the TLS bootstrap credentials, and with those an attacker could read the secrets of every workload in the cluster.
Prayer
O Blessed WireServing, who pulls the node's hidden wire, let our pods speak only to the services they truly need. Amen.
How to celebrate
Celebrated by applying NetworkPolicies that block access to 168.63.129.16, to 169.254.0.0/16 and to the endpoints nobody should call.
A hanging wire is a wire someone will pull.