AWS has patched a rather embarrassing Kubernetes bug TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. AWS has patched a rather embarrassing Kubernetes bug By Sead Fadilpašić published 13 July 2022 Letter capitalization bug could lead to escalated AWS Kubernetes privileges (Image credit: Pixabay) Audio player loading… Amazon Web Services (AWS) has patched a rather embarrassing bug that could allow threat actors to gain elevated privileges on a Kubernetes cluster. The bug was found in the IAM Authenticator for Kubernetes, a plugin tool used by Amazon EKS - a managed container service to run and scale Kubernetes applications. Detailing its findings in a security advisory, AWS explained that the bug manifested when the authenticator plugin gets configured to use the AccessKeyID template parameter. In all other scenarios, users were not in harm's way. Duplicate parameter names The flaw was first discovered by Lightspin's Director of Security Research Gafnit Amiga. In a blog post (opens in new tab), she noted: "I found several flaws in the authentication process that could bypass the protection against replay attacks or allow an attacker to gain higher permissions in the cluster by impersonating other identities." The flaw is tracked as CVE-2022-2385, Amiga further says, explaining that the code should check the capitalization of the parameter, but it doesn't, and that leads to the bug. Threat actors can create duplicate parameter names, and use them to gain elevated privileges. Execution is easier said than done, though. "Because the for loop is not ordered, the parameters are not always overridden in the order we want, therefore we might need to send the request with the malicious token to the AWS IAM Authenticator server multiple times," Amiga concluded.Read more> Here's our take on the best firewalls today (opens in new tab) > Nearly half a million Kubernetes servers left open to the Internet (opens in new tab) > Kubernetes security report finds people have no idea how to use Kubernetes (opens in new tab) All existing EKS clusters were patched late last month, while the new IAM Authenticator for the Kubernetes version is no longer vulnerable, requiring no further action from the users. Still, those that host and manage their own Kubernetes clusters and use the IAM Authenticator's AccessKeyID template parameter, should make sure the plugin is updated to 0.5.9. The bug was first introduced in late 2017, but it wasn't until September 2020 that it was exploitable, she concluded.These are the best endpoint protection services (opens in new tab) right now Via: The Register (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have to sell a body part to afford the Nvidia RTX 4090 after all2It looks like Fallout's spiritual successor is getting a PS5 remaster3My days as a helpful meat shield are over, thanks to the Killer Klown horror game4One of the world's most popular programming languages is coming to Linux5The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me1We finally know what 'Wi-Fi' stands for - and it's not what you think2Best laptops for designers and coders 3The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me4Miofive 4K Dash Cam review5Logitech's latest webcam and headset want to relieve your work day frustrations Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)