Kubernetes Service Account Token Abuse Detection

/var/run/secrets/kubernetes.io/serviceaccount/
├── token ← JWT bearer token (the crown jewel)
├── ca.crt ← Cluster CA certificate
└── namespace ← Pod's namespace name

┌───────────────────────────────────────────────────────────────────────┐
│ SERVICE ACCOUNT TOKEN ABUSE ATTACK CHAIN │
├───────────────────────────────────────────────────────────────────────┤
│ │
│ VECTOR 1: Unauthenticated Secrets API │
│ ───────────────────────────────────── │
│ GET /api/v1/secrets (no auth) → tokens exposed as base64 data │
│ GET /api/v1/namespaces/default/secrets → same, scoped to namespace │
│ ↓ │
│ VECTOR 2: Kubelet /pods Endpoint (port 10250) │
│ ──────────────────────────────────────────── │
│ GET https://node:10250/pods → reveals ALL token mount paths │
│ Combined with /exec → read token directly from container filesystem │
│ ↓ │
│ VECTOR 3: Default SA Automount Enabled │
│ ───────────────────────────────────── │
│ All pods inherit default SA token → compromise any pod = get token │
│ ↓ │
│ VECTOR 4: Token Pivoting │
│ ──────────────────────── │
│ Extracted token → GET /api/v1/namespaces/kube-system/secrets │
│ → Read cluster CA, etcd certs, admin credentials → FULL TAKEOVER │
│ │
└───────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────┐
│ CERT-X-GEN DETECTION FLOW │
├──────────────────────────────────────────────────────────────────────┤
│ │
│ Check 1: Secrets API │
│ Scanner ──GET /api/v1/secrets (no auth)──► API Server :6443 │
│ 200 OK? → Extract base64 tokens → CRITICAL finding │
│ 401/403? → Properly secured → skip │
│ ↓ │
│ Check 2: Kubelet /pods │
│ Scanner ──GET /pods (no auth)──► Kubelet :10250 │
│ 200 OK? → Parse PodList → count SA token mounts → CRITICAL │
│ 401/403? → Properly secured → skip │
│ ↓ │
│ Check 3: Service Account Automount │
│ Scanner ──GET /api/v1/namespaces/default/serviceaccounts──► │
│ 200 OK? → Check automountServiceAccountToken field → HIGH │
│ 401/403? → Properly secured → skip │
│ ↓ │
│ Check 4: Token Pivoting │
│ For each token extracted in Check 1: │
│ Scanner ──GET /api/v1/namespaces/kube-system/secrets──► │
│ 200 OK? → Pivot successful → CRITICAL (CVSS 10.0) │
│ 401/403? → Token has limited scope → no finding │
│ │
└──────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────┐
│ SERVICE ACCOUNT JWT TOKEN STRUCTURE │
├──────────────────────────────────────────────────────────────────────┤
│ │
│ eyJhbGciOiJSUzI1NiIsImtpZCI6Ii4uLiJ9 │
│ └─── Header: {"alg":"RS256","kid":"<key-id>"} │
│ │
│ .eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50IiwK... │
│ └─── Payload: │
│ { │
│ "iss": "kubernetes/serviceaccount", │
│ "kubernetes.io/serviceaccount/namespace": "default", │
│ "kubernetes.io/serviceaccount/service-account.name": "...", │
│ "kubernetes.io/serviceaccount/service-account.uid": "...", │
│ "sub": "system:serviceaccount:default:vuln-sa" ← identity │
│ } │
│ │
│ .<signature> │
│ └─── Signed by cluster's service account signing key │
│ Valid until token rotation or secret deletion │
│ │
└──────────────────────────────────────────────────────────────────────┘

// Probe cluster-scoped and namespace-scoped secrets endpoints
namespacesToProbe := []string{"", "default", "kube-system", "kube-public"}

for _, ns := range namespacesToProbe {
 resp, body, err := get(ctx, client, endpoint, "") // no token = anonymous
 
 if resp.StatusCode == 200 {
 // Parse SecretList, filter for kubernetes.io/service-account-token type
 // Decode base64 token data to confirm JWT format (eyJ prefix)
 // Return CRITICAL finding with extracted token previews
 }
}

// Probe both /pods and /runningpods/ endpoints on port 10250
for _, pod := range podList.Items {
 for _, vm := range container.VolumeMounts {
 if strings.Contains(vm.MountPath, "serviceaccount") {
 // Record pod name, namespace, SA name, exact mount path
 // Each entry = one extractable token via /exec
 }
 }
}

// Ordered by sensitivity — stop at first accessible privileged endpoint
pivotEndpoints := []struct{ path, description string; cvss float64 }{
 {"/api/v1/namespaces/kube-system/secrets", "kube-system secrets", 10.0},
 {"/api/v1/namespaces/kube-system/configmaps", "kube-system configmaps", 8.5},
 {"/apis/rbac.authorization.k8s.io/v1/clusterrolebindings", "RBAC privilege map", 8.0},
 {"/api/v1/nodes", "node inventory", 7.5},
 {"/api/v1/namespaces", "all namespaces", 7.0},
}

// CVSS score of the finding = highest accessible endpoint's score
// This gives a precise measure of the token's actual blast radius

# Scan a Kubernetes node for service account token abuse vectors
cxg scan --scope 10.0.0.1 --template templates/service-account-token-abuse/service-account-token-abuse.go

# Scan with JSON output and verbose logging
cxg scan --scope 10.0.0.1 --template templates/service-account-token-abuse/service-account-token-abuse.go --output-format json --timeout 30s -vv

# Scan multiple nodes from a targets file
cxg scan --scope @k8s-nodes.txt --template templates/service-account-token-abuse/service-account-token-abuse.go --output-format json --timeout 30s

# Run directly with Go for verbose stderr output
cd templates/service-account-token-abuse
go run service-account-token-abuse.go <target-ip>

[{
 "template_id": "service-account-token-abuse",
 "host": "172.19.0.2",
 "severity": "CRITICAL",
 "confidence": 95,
 "title": "Kubelet API Exposes Pod Service Account Token Mount Paths on 172.19.0.2:10250",
 "description": "The Kubelet API on port 10250 responds without authentication to /pods. 10 pods are enumerated, 6 of which have service account tokens automounted at predictable paths...",
 "evidence": {
 "kubelet_endpoint": "https://172.19.0.2:10250/pods",
 "http_status": 200,
 "total_pods": 10,
 "pods_with_sa_tokens": 6,
 "token_mount_details": [
 {
 "pod": "vuln-pod",
 "namespace": "default",
 "service_account": "vuln-sa",
 "token_mountpaths": ["nginx:/var/run/secrets/kubernetes.io/serviceaccount"]
 }
 ],
 "token_path_pattern": "/var/run/secrets/kubernetes.io/serviceaccount/token"
 },
 "cwe": "CWE-522",
 "cvss_score": 9.6
}]

[-] Secrets API: no unauthenticated access detected
[-] Kubelet: /pods not accessible without authentication
[-] SA check: no over-permissioned service accounts detected
[-] Token pivoting: no privileged endpoints accessible
[]

# Confirmed token works against kube-system secrets
TOKEN=$(kubectl get secret vuln-sa-token -n default -o jsonpath='{.data.token}' | base64 -d)
curl -sk https://172.19.0.2:6443/api/v1/namespaces/kube-system/secrets \
 -H "Authorization: Bearer $TOKEN" | head -3
# → {"kind":"SecretList","apiVersion":"v1",...} ← Full access confirmed

# /var/lib/kubelet/config.yaml — Secure configuration
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
 anonymous:
 enabled: false # ← Disable anonymous access
 webhook:
 enabled: true # ← Require token authentication
 cacheTTL: 2m
 x509:
 clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
 mode: Webhook # ← Use K8s RBAC for authorization
 webhook:
 cacheAuthorizedTTL: 5m
 cacheUnauthorizedTTL: 30s

# Disable automounting on the default service account
apiVersion: v1
kind: ServiceAccount
metadata:
 name: default
 namespace: default
automountServiceAccountToken: false # ← Opt-out of automounting
---
# For workloads that need API access: dedicated SA + scoped role
apiVersion: v1
kind: ServiceAccount
metadata:
 name: app-sa
 namespace: my-app
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
 name: app-role
 namespace: my-app
rules:
 - apiGroups: [""]
 resources: ["configmaps"] # ← Only what the app needs
 verbs: ["get", "list"]

# Pod spec — use projected token with 1 hour expiry
spec:
 volumes:
 - name: token
 projected:
 sources:
 - serviceAccountToken:
 path: token
 expirationSeconds: 3600 # ← 1 hour, not indefinite
 audience: my-app
 containers:
 - name: app
 volumeMounts:
 - name: token
 mountPath: /var/run/secrets/tokens

# Disable automount on default SA in all namespaces
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
 kubectl patch serviceaccount default -n $ns \
 -p '{"automountServiceAccountToken": false}'
done

# Audit all SA token secrets
kubectl get secrets --all-namespaces \
 --field-selector type=kubernetes.io/service-account-token

# Find ClusterRoleBindings granting cluster-admin to SAs
kubectl get clusterrolebindings -o json | \
 jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'

// Extend Check 2 to attempt actual token extraction via exec
execURL := fmt.Sprintf("https://%s:10250/exec/%s/%s/%s?command=cat&command=/var/run/secrets/kubernetes.io/serviceaccount/token&input=0&output=1&tty=0",
 host, pod.Metadata.Namespace, pod.Metadata.Name, container.Name)
// POST to execURL with websocket upgrade → receive token content

// Detect AWS IRSA annotations (IAM role for SA)
if annotations["eks.amazonaws.com/role-arn"] != "" {
 // SA has AWS IAM permissions via token exchange
 // Elevated finding: cloud account access possible
}

# GitHub Actions — scan K8s cluster nodes after deployment
- name: Service Account Token Abuse Scan
 run: |
 for NODE_IP in ${{ secrets.K8S_NODE_IPS }}; do
 cxg scan \
 --scope $NODE_IP \
 --template templates/service-account-token-abuse/service-account-token-abuse.go \
 --output-format json \
 --timeout 30s \
 --output sa-token-results-$NODE_IP.json
 done