Kubernetes RBAC Misconfiguration: Privilege Escalation Path Detection

Request → Authentication → Authorization (RBAC) → Admission Control → API Action

--insecure-port=8080 # Accepts ALL requests — no auth, no TLS
--insecure-bind-address=... # Often set to 0.0.0.0 (internet-facing!)

ClusterRoleBinding: cluster-admin → system:anonymous

┌─────────────────────────────────────────────────────────────────────┐
│ K8S RBAC PRIVILEGE ESCALATION CHAIN │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ Attacker ──GET──► :8080/api │
│ │ (no auth, no TLS) │
│ │ ↓ │
│ │ 200 OK + APIVersions JSON │
│ │ ↓ │
│ ├──GET──► :8080/api/v1/namespaces → Lists all namespaces │
│ ├──GET──► :8080/api/v1/secrets → Reads ALL secrets │
│ ├──POST──► :8080/api/v1/pods → Creates privileged pod │
│ └──POST──► :8080/exec → Executes in containers │
│ │
│ OR (Anonymous auth path): │
│ │
│ Attacker ──GET──► :6443/api (no bearer token) │
│ │ 200 OK → anonymous access enabled │
│ │ ↓ │
│ ├──GET──► ClusterRoleBindings → finds cluster-admin binding │
│ └──────► Full cluster control without credentials │
│ │
└─────────────────────────────────────────────────────────────────────┘

# What Nuclei CAN do:
id: k8s-port-open
requests:
 - method: GET
 path:
 - "{{BaseURL}}:8080/api"
 matchers:
 - type: word
 words:
 - '"kind"'

┌──────────────────────────────────────────────────────────────────────┐
│ CERT-X-GEN DETECTION FLOW (3 CHECKS) │
├──────────────────────────────────────────────────────────────────────┤
│ │
│ CHECK 1: Insecure Port │
│ Template ──HTTP GET──► :8080/api │
│ │ │
│ ├── 200 + "APIVersions" → CRITICAL (CVSS 10.0) │
│ │ └── Bonus: GET :8080/api/v1/namespaces → enumerate │
│ └── Error/non-200 → graceful skip │
│ │
│ CHECK 2: Anonymous Auth (strict TLS) │
│ Template ──HTTPS GET──► :6443/api (no bearer token) │
│ │ │
│ ├── TLS error → graceful skip (self-signed cert) │
│ ├── 401/403 → INFO: properly secured │
│ ├── 200 + "APIVersions" → anonymous access confirmed │
│ │ └── GET :6443/.../clusterrolebindings → enumerate RBAC │
│ │ ├── Dangerous binding found → CRITICAL (CVSS 9.8) │
│ │ └── No dangerous binding → HIGH (CVSS 8.8) │
│ └── Other → skip │
│ │
│ CHECK 3: Dashboard Exposure │
│ Template ──HTTP GET──► :8001/proxy/dashboard │
│ Template ──HTTPS GET──► :443/ │
│ │ │
│ ├── Dashboard signal + no login → CRITICAL (CVSS 9.6) │
│ ├── Dashboard signal + login page → HIGH (CVSS 7.5) │
│ └── No signal → skip │
│ │
└──────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────┐
│ SEVERITY DETERMINATION │
├──────────────────────────────────────────────────────────────────────┤
│ │
│ Port 8080 open + K8s API confirmed │
│ └──► CRITICAL (CVSS 10.0) — full unauth cluster-admin │
│ │
│ Port 6443 anonymous + dangerous ClusterRoleBinding found │
│ └──► CRITICAL (CVSS 9.8) — proven privilege escalation path │
│ │
│ Port 6443 anonymous + no dangerous ClusterRoleBinding │
│ └──► HIGH (CVSS 8.8) — resource enumeration, partial access │
│ │
│ Dashboard on 8001/443 + no login required │
│ └──► CRITICAL (CVSS 9.6) — GUI cluster-admin without creds │
│ │
│ Dashboard on 8001/443 + login page exposed │
│ └──► HIGH (CVSS 7.5) — brute-force / token theft surface │
│ │
│ Port 6443 returns 401/403 │
│ └──► INFO — properly secured, authentication required │
│ │
└──────────────────────────────────────────────────────────────────────┘

// testInsecurePort tests for Kubernetes insecure port 8080
func testInsecurePort(host string, port int) *Finding {
 baseURL := fmt.Sprintf("http://%s:%d", host, port)

 // Plain HTTP client — no TLS needed on insecure port
 client := &http.Client{Timeout: 10 * time.Second}
 resp, err := client.Do(req)

 // Confirm it is the K8s API by looking for canonical response fields
 if !strings.Contains(bodyStr, "APIVersions") && !strings.Contains(bodyStr, "apiVersion") {
 return nil // Not K8s — zero false positives
 }

 // Bonus: enumerate namespaces to gauge impact depth
 namespaceNames := enumerateNamespaces(baseURL, client)
 // → CRITICAL finding with namespace evidence
}

// Strict TLS — InsecureSkipVerify: false
client := &http.Client{
 Transport: &http.Transport{
 TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
 },
}
// No Authorization header — pure anonymous probe
resp, err := client.Do(req)
if err != nil {
 // TLS error = self-signed cert or unreachable — skip gracefully
 return nil
}
// 401/403 = properly secured → INFO finding
// 200 + K8s API body = anonymous access confirmed → escalate to RBAC check

// enumerateRBAC fetches ClusterRoleBindings and flags dangerous patterns
dangerousPrincipals := map[string]bool{
 "system:anonymous": true,
 "system:unauthenticated": true,
}
dangerousRoles := map[string]bool{
 "cluster-admin": true,
 "system:masters": true,
}
// For each ClusterRoleBinding:
// if subject is dangerous principal OR role is cluster-admin → flag it

# Scan a single Kubernetes cluster API server
cxg scan --scope k8s-api.example.com --template k8s-rbac-misconfiguration.go

# Scan multiple targets from file
cxg scan --scope @targets.txt --template k8s-rbac-misconfiguration.go

# JSON output with verbose logging
cxg scan --scope @targets.txt --template k8s-rbac-misconfiguration.go \
 --output-format json --timeout 30s -vv

# Scan with extended timeout for slow clusters
cxg scan --scope k8s-api.example.com --template k8s-rbac-misconfiguration.go \
 --timeout 60s --output-format json

[{
 "template_id": "k8s-rbac-misconfiguration",
 "template_name": "Kubernetes RBAC Misconfiguration Detection",
 "host": "151.115.72.137",
 "severity": "CRITICAL",
 "confidence": 98,
 "title": "Kubernetes Insecure API Port Exposed on 151.115.72.137:8080 — Full Unauthenticated Access",
 "description": "The Kubernetes API server is running with --insecure-port=8080 enabled...",
 "evidence": {
 "port": 8080,
 "protocol": "http",
 "authentication": "not_required",
 "tls": false,
 "namespaces_found": ["default", "kube-system", "kube-public", "production"],
 "namespace_count": 4,
 "vulnerability": "--insecure-port=8080 enabled; full unauthenticated, unencrypted API access"
 },
 "cvss_score": 10.0
}]

[{
 "template_id": "k8s-rbac-misconfiguration",
 "severity": "CRITICAL",
 "confidence": 95,
 "title": "Kubernetes RBAC Privilege Escalation via Anonymous Access on 10.0.0.1:6443",
 "evidence": {
 "anonymous_access": true,
 "dangerous_bindings": [
 "ClusterRoleBinding 'anon-admin': role='cluster-admin' granted to Group 'system:unauthenticated'"
 ],
 "clusterrolebindings_total": 42,
 "dangerous_binding_count": 1
 },
 "cvss_score": 9.8
}]

[{
 "template_id": "k8s-rbac-misconfiguration",
 "severity": "INFO",
 "confidence": 100,
 "title": "Kubernetes API Server Properly Secured on 10.0.0.1:6443",
 "evidence": {
 "authentication": "required",
 "anonymous_access": false,
 "tls_verification": "strict"
 }
}]

WARN: Template k8s-rbac-misconfiguration failed for target 182.92.110.203: Operation timed out after 30s

# /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
 containers:
 - command:
 - kube-apiserver
 - --insecure-port=0 # ← Disable completely
 - --secure-port=6443
 - --anonymous-auth=false # ← Disable anonymous auth

# Verify current state
kubectl get pod kube-apiserver-<node> -n kube-system -o yaml | grep anonymous

# Fix: add --anonymous-auth=false to kube-apiserver command flags
# Then verify no anonymous bindings exist:
kubectl get clusterrolebindings -o json | \
 jq '.items[] | select(.subjects[]?.name == "system:anonymous" or .subjects[]?.name == "system:unauthenticated")'

# Find all ClusterRoleBindings with dangerous subjects
kubectl get clusterrolebindings -o wide | grep -E "system:anonymous|system:unauthenticated"

# Delete dangerous bindings (example)
kubectl delete clusterrolebinding <binding-name>

# Audit all cluster-admin bindings
kubectl get clusterrolebindings -o json | \
 jq '.items[] | select(.roleRef.name == "cluster-admin") | .metadata.name + ": " + (.subjects[]? | .kind + "/" + .name)'

# Option 1: Access Dashboard only via local port-forward (recommended)
kubectl port-forward -n kubernetes-dashboard svc/kubernetes-dashboard 8443:443

# Option 2: Delete Dashboard if not needed
kubectl delete namespace kubernetes-dashboard

# Option 3: Use oauth2-proxy in front of Dashboard
# See: https://github.com/oauth2-proxy/oauth2-proxy

// Add a check for etcd exposure (port 2379 — full cluster state DB)
func testEtcdExposure(host string) *Finding {
 conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:2379", host), 5*time.Second)
 if err != nil {
 return nil
 }
 conn.Close()
 // etcd accessible = critical — contains entire cluster state including secrets
 return &Finding{
 Severity: "CRITICAL",
 CVSSScore: 10.0,
 Title: "etcd Port 2379 Exposed Without Authentication",
 }
}

// Test if a leaked service account token still works
func testTokenValidity(host string, token string) *Finding {
 req.Header.Set("Authorization", "Bearer " + token)
 // 200 = token valid → privilege level finding based on response
}

# GitHub Actions: scan K8s cluster before deployment
- name: K8s RBAC Security Scan
 run: |
 cxg scan \
 --scope ${{ secrets.K8S_API_ENDPOINT }} \
 --template k8s-rbac-misconfiguration.go \
 --output-format json \
 --timeout 30s \
 --output k8s-scan-results.json
 
 # Fail pipeline if CRITICAL findings exist
 CRITICAL=$(cat k8s-scan-results.json | jq '[.findings[] | select(.severity=="critical")] | length')
 if [ "$CRITICAL" -gt "0" ]; then
 echo "CRITICAL K8s RBAC misconfiguration found! Blocking deployment."
 exit 1
 fi