Attack Chain

1. Attacker gains access to the provisioning network segment.
2. Attacker probes the OpenShift provisioning controller on TCP port 8084.
3. Attacker sends a GET request to the root path (/) to retrieve the browsable directory listing.
4. Attacker parses the response to enumerate all image file names (UUIDs).
5. Attacker downloads specific ISO or initramfs images using the enumerated UUIDs.
6. Attacker extracts the embedded Ignition configuration files from the downloaded images.
7. Attacker decodes the base64 cluster pull secrets and retrieves sensitive SSH keys and network configuration parameters.

Impact

Successful exploitation allows an adjacent attacker to gain unauthorized access to sensitive cluster credentials, including the cluster pull secret and SSH keys. This facilitates further compromise of the OpenShift environment or lateral movement within the provisioning network.

Recommendation

• Restrict network access to port 8084 on the OpenShift image-customization-controller to trusted management or provisioning subnets using network policies or firewall rules.
• Audit existing Ignition configuration files for exposed secrets until a vendor patch is applied.
• Monitor logs for unauthorized HTTP requests to the provisioning controller endpoint, specifically directory listing attempts or bulk image downloads.