Palo Alto Networks Unit 42 Threat Intelligence team discovered a vulnerability allowing a public cloud tenant to escape their environment and execute code on other cloud users’ environment on the same cloud services.
The cross-account container takeover vulnerability affects the Microsoft Azure Container-as-a-Service (CaaS) platform. Azure containers allow users to access Docker containers on serverless environments without the need for virtual machines, orchestrators, or clusters.
Dubbed Azurescape, the container escape technique allows a malicious user to escalate privileges on a shared cloud platform and compromise other users.
Unit 42 security researcher Yuval Avrahami discovered the vulnerability and received two bug bounties from Microsoft for an undisclosed amount.
A three-step attack allows Microsoft cloud services cross-account takeover
The attack begins by breaking out of their Azure Container Instances (ACI), then gaining administrative privileges over a multitenant Kubernetes cluster. Lastly, the attacker gains control of other users’ Azure containers through malicious code execution.
Unit 42 researchers used the WhoC container runtime discovery image to expose underlying containers. They then discovered that they could exploit CVE-2019-5736 runC vulnerability to escape from their container by executing malicious code on the API server. The vulnerability has existed for two years.
“The main issue here involves the service provider failing to run the latest version of runC, which according to the original report, has had an available patch for this vulnerability that would’ve mitigated the attack itself,” Josh Angell, Managing Consultant at nVisium. “The vulnerability in runC allows a user to override the runC binary, thus allowing the user to gain root-level code execution on the host.”
Microsoft has received more criticism for failing to implement simple security mitigations that would prevent serious attacks.
According to the researchers, an attacker could gain access to other users’ Azure containers and perform code execution, exfiltrate data, or abuse the victim’s infrastructure for crypto mining.
They added that determined attackers could use hijacked cloud containers to target other victims outside the cloud services.
“Sophisticated attackers may not be satisfied with targeting end-users, and may expand their campaigns to the platforms themself to increase impact and reach,” the researchers wrote.
Microsoft fixes Azure container vulnerability
Palo Alto Networks’ security research team indicated that they had not detected any real-world exploit of the Azurescape Microsoft cloud services vulnerability. However, they suggested that the Azure container vulnerability existed since the inception of ACI.
“ACI is built on multitenant clusters that host customer containers. Originally those were Kubernetes clusters, but over the past year Microsoft started hosting ACI on Service Fabric clusters as well,” the researchers found.
Thus, it was difficult to determine if any Microsoft azure customers were affected before Microsoft adopted the new architecture.
“We don’t know of a way to check whether a past ACI container ran on top of Kubernetes.”
They also noted that the flaw created an attack vector that hackers could exploit to target public cloud services. The rapid adoption of cloud services makes them attractive targets for attackers, they said.
Microsoft addressed the Azure container vulnerability immediately after Unit 42 reported the flaw. And recommended revoking any privileged credentials that were deployed on Azure Container Instances (ACI) before August 31. The company also notified customers with vulnerable containers through the Service Health Notifications in the Azure Portal.
Microsoft Security Response Center (MSRC) blog post says that Azure customers who never received the notification were not at risk.
Unit 42 researchers also advised Microsoft cloud services customers to adopt a “defense-in-depth approach.”
They should also check for any suspicious activity by analyzing access logs. Additionally, they should rotate any privileged credentials deployed before this discovery. To prevent future attacks, they should implement a comprehensive cloud-native security platform.
“There’s no doubt that the public cloud is an incredible enabler of business agility and net positive for organizations making the cloud transition,” Douglas Murray, CEO at Valtix, said. “However, what Azurescape and other such platform service vulnerabilities continue to highlight is that the already difficult task of security is different in the cloud. Zero-day vulnerabilities will continue to occur and the shared responsibility model often complicates remediation.”