Kubectl: Unauthorized configuration deployment via remote URLs
Adversaries may use the kubectl apply command with external URL arguments to deploy malicious or unauthorized container configurations into a Kubernetes cluster.
Triage facts
Revision 1- Applicability
- Kubernetes
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 22:01 UTC
- Source quality
- B2Roughly even chance
The kubectl apply command can be used to deploy resources directly from remote URLs. Threat actors can abuse this functionality to deploy malicious pods or modify existing ones, potentially leading to unauthorized access, data exfiltration, or the deployment of malicious configurations within a Kubernetes cluster.
Recommendation
Detection teams should monitor process execution for kubectl using URL-based arguments and create exceptions for legitimate CI/CD pipeline traffic, administrative tasks, and monitoring tools.
Immediate actions
Identify and whitelist legitimate URLs used by administrators and CI/CD pipelines to reduce false positives.
Threat Hunt
Audit Kubernetes cluster logs and process execution details to identify source IPs and URLs associated with kubectl apply commands.
Mitigations
Implement network policies and role-based access controls (RBAC) to limit the ability to apply configurations from external URLs.