AWS fixed three authentication bugs present in one line of code in its IAM Authenticator for Kubernetes, used by the cloud giant’s popular managed Kubernetes service Amazon EKS, that could allow an attacker to escalate privileges within a Kubernetes cluster.
The security issues, tracked as CVE-2022-2385, occurred because of this code line in the parameter validation, according to Amiga. It’s supposed to check the capitalization of the parameter.
The flaws have been around for some time. “The vulnerable root cause was in AWS IAM Authenticator since first commit (Oct 12, 2017), therefore both changing action and unsigned cluster ID tokens were exploitable since day one,” Amiga explained.
Meanwhile, it is possible to have exploited the username through the AccessKeyID since September 2, 2020, when AWS added this feature.
A local file read vulnerability in Amazon’s Relational Database Service (RDS) could have been exploited by an attacker to gain access to internal AWS credentials. By April AWS had applied an initial patch and worked with customers to mitigate the vulnerability.