Information disclosure in Azure Active Directory Pod Identity for Kubernets - CVE-2021-1677
Published: January 12, 2021 / Updated: January 12, 2021
Vulnerability identifier: #VU49490
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1677
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information.
The AAD pod identity enables users to assign identities to pods in Kubernetes clusters and fetch them from the pods using a regular IMDS (Azure Instance Metadata Service) request. When an identity is assigned to a pod, the pod can access to the IMDS endpoint and get a token of that identity. An attacker who successfully exploited this vulnerability can laterally steal the identities that are associated with different pods.
Affected software
Azure Active Directory Pod Identity for Kubernets
How to mitigate CVE-2021-1677
Install updates from vendor's website.
Azure Active Directory Pod Identity for Kubernets - update to 1.7.0