Istio Pilot Misconfiguration: Service Mesh Control Plane Exposure

┌─────────────────────────────────────────────────────────────────┐
│ ISTIO PILOT ATTACK SURFACE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Port 15010 (xDS plaintext gRPC): │
│ Attacker ──► Connect Envoy/xDS client ──► Receive ALL: │
│ • ClusterDiscoveryService (CDS) responses │
│ • EndpointDiscoveryService (EDS) responses │
│ • ListenerDiscoveryService (LDS) responses │
│ • RouteDiscoveryService (RDS) responses │
│ • SecretDiscoveryService (SDS) — TLS certs │
│ │
│ Port 8080 (HTTP admin): │
│ Attacker ──► GET /debug/endpointz ──► Full endpoint table │
│ Attacker ──► GET /metrics ──► Mesh telemetry │
│ Attacker ──► GET /ready ──► Istiod presence │
│ │
│ Port 15014 (monitoring): │
│ Attacker ──► GET /metrics ──► Control plane internals │
│ Attacker ──► GET /debug/configz ──► Full mesh config │
│ │
└─────────────────────────────────────────────────────────────────┘

# What a YAML scanner CAN do:
id: istio-port-check
requests:
 - method: GET
 path:
 - "{{BaseURL}}:8080/ready"
 matchers:
 - type: status
 status: [200, 503]

┌──────────────────────────────────────────────────────────────────┐
│ CERT-X-GEN DETECTION FLOW │
├──────────────────────────────────────────────────────────────────┤
│ │
│ 1. Probe port 8080 /ready │
│ ├── 200 or 503 → Istio present → HIGH finding │
│ ├── 401/403 → Port exists but protected → skip │
│ └── unreachable → skip │
│ │
│ 2. Probe port 8080 /debug/endpointz │
│ ├── 200 + Istio content → CRITICAL finding │
│ ├── 401 → debug protected (log, no finding) │
│ └── 404 → endpoint not present │
│ │
│ 3. Probe port 8080 /metrics │
│ └── 200 + pilot_/istio_ prefix → HIGH finding │
│ │
│ 4. TCP connect to port 15010 │
│ ├── Connect success → send HTTP/1.1 GET │
│ ├── Any response (reset/empty/HTTP) → CRITICAL finding │
│ └── Connection refused/timeout → skip │
│ │
│ 5. Probe port 15014 /metrics │
│ └── 200 + istio_ metrics → HIGH finding │
│ │
└──────────────────────────────────────────────────────────────────┘

┌──────────────┬──────────────────────────────────┬──────────┐
│ Port │ Impact if Exposed │ Severity │
├──────────────┼──────────────────────────────────┼──────────┤
│ 15010 (xDS) │ Full mesh config, TLS certs, │ CRITICAL │
│ │ rogue proxy registration │ CVSS 9.1 │
├──────────────┼──────────────────────────────────┼──────────┤
│ 8080 (admin) │ Endpoint enumeration, metrics, │ HIGH │
│ │ control plane status │ CVSS 7.5 │
├──────────────┼──────────────────────────────────┼──────────┤
│ 15014 (mon.) │ Internal telemetry, debug config │ HIGH │
│ │ │ CVSS 7.5 │
└──────────────┴──────────────────────────────────┴──────────┘

// The key insight: use net.DialTimeout, not http.Client
// http.Client would fail on gRPC TCP reset and return "unreachable"
// net.DialTimeout succeeds at TCP layer — proving the port is exposed
func probePort15010(host string) *Finding {
 address := fmt.Sprintf("%s:15010", host)
 conn, err := net.DialTimeout("tcp", address, 5*time.Second)
 if err != nil {
 return nil // Genuinely unreachable
 }
 defer conn.Close()

 // TCP connected — port IS exposed, regardless of gRPC response
 conn.SetDeadline(time.Now().Add(5 * time.Second))
 conn.Write([]byte("GET /ready HTTP/1.1\r\nHost: " + host + "\r\n\r\n"))
 
 // Read whatever comes back (may be gRPC reset frame or empty)
 buf := make([]byte, 256)
 n, _ := conn.Read(buf)
 
 // TCP connect success = CRITICAL finding
 return buildFinding(host, "critical", 9.1, ...)
}

// 503 on /ready is NOT an error — it's proof Istio is present
// istiod returns 503 when it hasn't synced with Kubernetes yet
// Both 200 AND 503 are valid positive indicators
if readyResult.StatusCode == 200 || readyResult.StatusCode == 503 {
 // Istio is here — port is exposed
 findings = append(findings, buildFinding(...))
}

// Don't just check status 200 — verify Istio-specific metric names
// Prevents false positives from other services on the same port
if strings.Contains(result.Body, "pilot_") || 
 strings.Contains(result.Body, "istio_") || 
 strings.Contains(result.Body, "grpc_") {
 // Confirmed Istio metrics — generate finding
}

# Scan a target for Istio Pilot misconfiguration
cxg scan --scope k8s-node.example.com --template templates/istio-pilot-misconfiguration/istio-pilot-misconfiguration.go

# With JSON output
cxg scan --scope k8s-node.example.com --template templates/istio-pilot-misconfiguration/istio-pilot-misconfiguration.go --output-format json

# Verbose mode
cxg scan --scope k8s-node.example.com --template templates/istio-pilot-misconfiguration/istio-pilot-misconfiguration.go -vv

# Scan multiple targets from file
cxg scan --scope @targets.txt --template templates/istio-pilot-misconfiguration/istio-pilot-misconfiguration.go --output-format json --timeout 30s

[
 {
 "template_id": "istio-pilot-misconfiguration",
 "severity": "critical",
 "confidence": 90,
 "title": "Istio xDS Plaintext gRPC Port Exposed on 10.0.0.5:15010",
 "description": "Istio Pilot xDS plaintext gRPC port (15010) is reachable without authentication...",
 "evidence": {
 "address": "10.0.0.5:15010",
 "port": 15010,
 "tcp_reachable": true,
 "authentication": "none",
 "protocol": "gRPC plaintext (xDS)"
 },
 "cvss_score": 9.1,
 "cwe": "CWE-306"
 },
 {
 "template_id": "istio-pilot-misconfiguration",
 "severity": "high",
 "confidence": 90,
 "title": "Istio Admin HTTP Port Exposed on 10.0.0.5:8080",
 "description": "Istio Pilot admin HTTP server (port 8080) is reachable without network restrictions...",
 "evidence": {
 "url": "http://10.0.0.5:8080/ready",
 "http_status": 503,
 "authentication": "not_required"
 },
 "cvss_score": 7.5,
 "cwe": "CWE-306"
 }
]

Scan Summary
 Findings: 0
 (All Istio ports unreachable or returning 401/403)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: restrict-istiod-ports
 namespace: istio-system
spec:
 podSelector:
 matchLabels:
 app: istiod
 policyTypes:
 - Ingress
 ingress:
 # Only allow xDS from within the cluster (port 15012 mTLS only)
 - ports:
 - port: 15012
 # Allow webhook from kube-apiserver only
 - ports:
 - port: 15017
 # Block 8080, 15010, 15014 from external sources

# Helm upgrade
helm upgrade istiod istio/istiod \
 --set pilot.env.PILOT_ENABLE_UNSAFE_UNPROTECTED_CLIENT_CONTROL=false

# IstioOperator
spec:
 components:
 pilot:
 k8s:
 env:
 - name: PILOT_ENABLE_UNSAFE_UNPROTECTED_CLIENT_CONTROL
 value: "false"

# IstioOperator — disable plaintext admin port
spec:
 meshConfig:
 defaultConfig:
 proxyAdminPort: 0 # Disable proxy admin port

// Additional Istio debug paths to probe on port 8080
extraPaths := []string{
 "/debug/configz", // Full mesh config dump
 "/debug/registryz", // Service registry
 "/debug/syncz", // xDS sync status per proxy
 "/debug/authorizationz", // AuthorizationPolicy state
 "/debug/push_status", // Push queue internals
}

// Check for sensitive metric labels that reveal workload identities
sensitiveMetrics := []string{
 "pilot_xds_pushes",
 "pilot_proxy_convergence_time",
 "citadel_secret_controller",
}

# GitHub Actions — scan Istio control plane on every deployment
- name: Istio Security Scan
 run: |
 cxg scan \
 --scope $ISTIOD_IP \
 --template templates/istio-pilot-misconfiguration/istio-pilot-misconfiguration.go \
 --output-format sarif \
 --output istio-results.sarif

- name: Upload SARIF
 uses: github/codeql-action/upload-sarif@v2
 with:
 sarif_file: istio-results.sarif