AWS IAM Authenticator

Exploiting Authentication in AWS IAM Authenticator for Kubernetes

Gafnit Amiga<
By: Gafnit Amiga
Jul 11, 2022

Amazon Elastic Kubernetes Service (Amazon EKS) is a managed service that helps you to create, operate, and maintain Kubernetes clusters. Amazon EKS has several deployment options including AWS cloud and on-premises (Amazon EKS Anywhere). Amazon EKS uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes. AWS IAM Authenticator is a component located inside your Kubernetes cluster’s control plane that enables…

Kubernetes NGINX

New Vulnerabilities in Kubernetes NGINX Ingress Controller

Gafnit Amiga<
By: Gafnit Amiga
Jul 6, 2022

Starting in October 2021, the NGINX’s Kubernetes Ingress Controller started to come under siege from security researchers and the open salvo was delivered in the form of CVE-2021-25742 which allowed attackers to gain access to secrets stored across all namespaces in a Kubernetes cluster. Around that time, the Panoptica Security Research & Development Team published a blog explaining the vulnerability, the potential impact of active exploitation, and provided Blue…

Group-38

NGINX Custom Snippets CVE-2021-25742

Gafnit Amiga<
By: Gafnit Amiga
Oct 27, 2021

Attackers can gain access to secrets across all namespaces The high severity alert known otherwise as CVE-2021-25742, was recently brought to the public’s attention and has prompted us to believe that it may be worthwhile to do a deeper dive into what this vulnerability really is and what it means for today’s organizations. Let’s jump right in! Here’s the CVE itself: CVE-2021-25742: Ingress-nginx custom snippets allows…