KodeKloud Notes

In this guide, we explore how attackers can execute unauthorized code in a Kubernetes cluster, identify common attack vectors, and implement robust mitigation strategies. You’ll learn to harden your environment against container exploits, API abuse, and repository poisoning.

What Is Malicious Code Execution?

Malicious code execution occurs when an adversary leverages a vulnerability in your application or cluster configuration to run unauthorized commands or binaries inside a container or on the host system. This can lead to privilege escalation, data exfiltration, or full cluster compromise.

Attack Vectors and Threat Model

Attackers may use one or more of the following methods:

Attack Vector	Description	Potential Impact
Import Tools or Scripts	Containers with `curl`, `wget`, or package managers download extra payloads.	Arbitrary code execution inside pods.
Modify Host Files	Mounted host filesystem allows tampering with config files or startup scripts.	Persistence and stealthy backdoors.
Host-Level Process Injection	Abusing host PID namespace or `SYS_PTRACE` to trace/inject into host processes.	Host compromise and lateral movement.

Warning

Granting SYS_PTRACE or enabling host PID namespaces is highly risky. Review Kubernetes Pod Security Standards before enabling any privileged capabilities.

The image is a flowchart illustrating various methods for executing processes in a running container, including importing malicious code, modifying host files, and starting processes with specific container privileges.

Post-Compromise via Kubernetes API

Once inside the container, an attacker can call the Kubernetes API to spawn new pods, trigger Denial of Service, or harvest credentials.

The image is a diagram titled "Compromised Application," showing a network of interconnected components, including pods, nodes, and APIs, with some elements marked as compromised.

Poisoning the Image Repository

If attackers obtain an image pull secret, they can push backdoored images to your registry. Subsequent deployments that pull these images will run malicious containers.

The image is a diagram illustrating the concept of "Poisoning the Image Repository," showing a flow of containers and pods interacting with Docker Hub and a host system. It includes elements like Nginx, Node.js, and MySQL, highlighting potential vulnerabilities.

Mitigation Strategies

1. Scan and Patch Vulnerabilities

Regularly scan container images and host OS for CVEs. Integrate vulnerability scanners like Trivy in your CI/CD pipeline and apply security patches promptly.

The image is a slide titled "Malicious Code Execution – Mitigating Risks," featuring icons for "Scanning vulnerabilities" and "Applying patches," with a note about updating servers and backend with security patches to reduce exploitation risk.

Note

Automate image scanning with every build. Block deployments if high-severity vulnerabilities are found.

2. Restrict API Server Access

Enforce strong authentication and granular RBAC policies so that only trusted identities can call sensitive API endpoints.

The image illustrates a concept of mitigating risks in malicious code execution, showing a user being blocked from accessing an API, with references to unauthorized command execution and RBAC (Role-Based Access Control).

3. Secure Image Repositories and Pull Secrets

Store your image pull secrets in encrypted vaults (e.g., HashiCorp Vault). Limit service accounts that can reference them and enforce image signing to verify integrity.

kubectl create secret docker-registry my-image-pull-secret \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-server=<registry-url> \
  --namespace=default

apiVersion: v1
kind: Pod
metadata:
  name: my-secure-pod
  namespace: default
spec:
  serviceAccountName: specific-service-account
  containers:
    - name: myapp
      image: <registry-url>/myapp:latest
  imagePullSecrets:
    - name: my-image-pull-secret

4. Monitor and Alert

Use audit logs and monitoring tools to detect exec calls, secret changes, or anomalous API usage. For Kubernetes clusters with Prometheus:

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: security-monitoring-rules
  namespace: default
spec:
  groups:
    - name: security-alerts
      rules:
        - alert: SecretChangeDetected
          expr: kube_secret_info
          for: 1m
          labels:
            severity: critical
          annotations:
            summary: "Secret Change Detected"
            description: "A change was detected in a Kubernetes Secret, which could indicate unauthorized access or tampering."
        - alert: CommandExecutionInContainer
          expr: increase(kube_audit_event_total{verb="exec"}[5m]) > 0
          for: 1m
          labels:
            severity: warning
          annotations:
            summary: "Exec API call detected in container"
            description: "An exec call was detected in container {{ $labels.container }} via the API. This might indicate suspicious activity."

5. Audit and Review

Periodically review RBAC roles, service account permissions, and image registry policies. Conduct penetration tests to validate your security posture.

The image is a slide titled "Malicious Code Execution – Mitigating Risks," featuring three key points: permissions for service accounts, security of image repositories, and access controls for API servers, along with an icon for auditing and reviewing.

Summary of Container Security Measures

Restrict API server access to authorized roles.
Secure image registries and enforce signed images.
Monitor audit logs and set up real-time alerts.
Keep containers and hosts up to date with patches.
Regularly audit RBAC, service accounts, and CI/CD pipelines.

The image is a summary slide listing five security measures for containers, including restricting API access, securing image repositories, monitoring activities, and updating applications. The slide has a gradient background with numbered points.

References

Watch Video

Watch video content