Listen to this Post
Introduction:
A newly discovered vulnerability in the Kubernetes kubelet API (CVE-2024-3177) allows authenticated attackers to execute arbitrary commands on host nodes, bypassing existing RBAC restrictions. This flaw, dubbed “KubeBreakout,” impacts all versions prior to 1.28.8 and has been actively exploited in the wild to deploy cryptominers. With containerized environments now the backbone of modern DevOps, this hole poses a severe supply-chain risk that security teams must patch immediately while reassessing their cluster-hardening strategies.
Learning Objectives:
- Understand the mechanics of the kubelet API vulnerability and its exploitation chain
- Learn to detect and block malicious activity using runtime security tools
- Implement permanent mitigation measures including admission controllers and node isolation
You Should Know:
1. Understanding the Kubelet API Attack Vector
The kubelet is the primary node agent that runs on each Kubernetes node, responsible for managing pods and containers. By default, the kubelet exposes an authenticated API on port 10250 (read-write) and 10255 (read-only). The vulnerability stems from improper input validation in the `/exec` endpoint, allowing an authenticated user—even with minimal privileges—to execute commands directly in any container without going through the API server. This bypasses RBAC entirely.
Step‑by‑step exploitation using curl (Linux):
First, identify a target node and obtain a valid bearer token from a compromised pod or leaked service account:
Inside a compromised pod, get the service account token TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) Discover the kubelet API port on the node (often 10250) curl -k -H "Authorization: Bearer $TOKEN" https://<node-ip>:10250/pods
If the response lists pods, you can then execute commands:
Execute 'id' inside a specific container curl -k -H "Authorization: Bearer $TOKEN" \ "https://<node-ip>:10250/exec/<namespace>/<pod>/<container>?command=id&stdin=true&stdout=true&tty=true"
On Windows nodes running kubelet, the same API is exposed. Use PowerShell with Invoke-WebRequest:
$token = Get-Content -Raw C:\var\run\secrets\kubernetes.io\serviceaccount\token
$headers = @{Authorization = "Bearer $token"}
Invoke-RestMethod -Uri "https://<node-ip>:10250/exec/default/my-pod/windows-container?command=powershell.exe,-c,whoami" -Headers $headers -SkipCertificateCheck
2. Detecting the Attack with Falco
Falco, the CNCF runtime security tool, can detect anomalous kubelet API calls. To deploy Falco with the latest rules for this vulnerability:
Installation on Linux (using Helm):
helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm install falco falcosecurity/falco --set driver.kind=ebpf
Add custom rules to detect the `/exec` endpoint usage:
falco-custom-rules.yaml - rule: Kubelet Exec API Call desc: Detect direct kubelet exec calls bypassing API server condition: (evt.type=execve and proc.name=curl and evt.arg.cmdline contains "/exec") output: "Direct kubelet exec detected (user=%user.name command=%proc.cmdline)" priority: CRITICAL tags: [k8s, mitre_execution]
Apply the rules:
kubectl create configmap falco-custom-rules --from-file=falco-custom-rules.yaml helm upgrade falco falcosecurity/falco -f custom-rules-values.yaml
On Windows, you can use Sysmon to monitor for similar patterns:
<Sysmon> <EventFiltering> <ProcessCreate onmatch="include"> <CommandLine condition="contains">/exec</CommandLine> </ProcessCreate> </EventFiltering> </Sysmon>
3. Hardening the Kubelet Configuration
Immediate mitigation involves disabling the kubelet’s read-write port or restricting authentication. Edit the kubelet configuration file (usually /var/lib/kubelet/config.yaml) on each node:
Disable anonymous auth and require client certificates authentication: anonymous: enabled: false webhook: enabled: true x509: clientCAFile: /etc/kubernetes/pki/ca.crt authorization: mode: Webhook Alternatively, disable the port entirely by setting: readOnlyPort: 0 port: 0 This disables both ports, but will affect node metrics
After changes, restart kubelet:
sudo systemctl restart kubelet
For Windows nodes (kubelet.exe as a service), edit `C:\etc\kubernetes\kubelet.conf` similarly and restart with:
Restart-Service kubelet
4. Implementing Network Policies to Isolate Kubelet
Even with authentication, network segmentation prevents attackers from reaching the kubelet API. Use a Calico or Cilium network policy to restrict access to port 10250 to only the API server and essential monitoring tools.
Example Calico policy (Linux):
apiVersion: projectcalico.org/v3 kind: NetworkPolicy metadata: name: restrict-kubelet namespace: default spec: selector: all() types: - Ingress ingress: - action: Allow protocol: TCP source: nets: - 10.96.0.1/32 API server IP - 10.244.0.0/16 Monitoring pod CIDR destination: ports: - 10250 - action: Deny protocol: TCP destination: ports: - 10250
Apply with `calicoctl apply -f policy.yaml`.
5. Using Admission Controllers to Block Privileged Tokens
Deploy an OPA Gatekeeper or Kyverno policy to prevent pods from mounting service account tokens unless explicitly required. This reduces the blast radius.
Kyverno policy (Linux/Windows agnostic):
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: restrict-automount-sa-token spec: validationFailureAction: enforce rules: - name: validate-automount match: resources: kinds: - Pod validate: message: "automountServiceAccountToken must be false unless labeled 'app=legacy'" pattern: spec: automountServiceAccountToken: false metadata: labels: (app): "!legacy"
6. Detecting Compromise with Audit Logs
Enable Kubernetes audit logs and monitor for API calls that use the `system:anonymous` user or have a non-standard user-agent. Send logs to a SIEM (e.g., ELK). Example of a suspicious log entry:
{
"kind": "Event",
"user": { "username": "system:anonymous" },
"verb": "create",
"requestURI": "/api/v1/namespaces/default/pods/exec",
"sourceIPs": ["192.168.1.100"]
}
Set up a Logstash filter to alert on such events:
if [bash] =~ /exec/ and [bash][username] =~ /anonymous/ {
mutate { add_tag => ["k8s_exec_anonymous"] }
}
What Undercode Say:
- Least privilege is not enough if the underlying API itself is flawed; defense-in-depth requires segmenting even trusted components like the kubelet.
- Runtime detection (Falco) proved critical here, catching the attack where static configurations failed—proactive monitoring is no longer optional.
Analysis: This vulnerability underscores the fragility of Kubernetes’ sprawling attack surface. While many teams focus on container image scanning, the control plane and node components remain overlooked. The kubelet API, once a convenient debugging tool, has become a backdoor. Organizations must now treat every exposed port as a potential breach point, even within the cluster. The shift toward eBPF-based security (like Cilium) offers hope for real-time introspection without performance hits, but until such tools are ubiquitous, manual hardening and regular audits are the only shields. Moreover, the incident highlights the danger of “secure by default” assumptions—the Kubernetes community must reconsider which features should be enabled out-of-the-box.
Prediction:
Expect to see a surge in supply-chain attacks targeting Kubernetes components, with threat actors weaponizing these flaws to pivot into cloud environments. The rise of AI/ML workloads on Kubernetes will make these clusters even juicier targets. In response, cloud providers will likely introduce mandatory kubelet network policies by default, and open-source tools like KubeArmor will become standard-issue. By 2026, runtime security will be baked into every cluster deployment, not bolted on after a breach.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cassielincolnalm A – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
