Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in kaniko, a container image builder, could allow an attacker to steal Azure access tokens. This occurs when kaniko processes a Dockerfile that references an image from a seemingly legitimate but attacker-controlled registry. The stolen token could grant unauthorized access to Azure resources and other container registries.
- Sensitive Azure tokens can be leaked.
- Build processes may expose cloud credentials.
- Confirm if build environments are affected.
Attack Path
How an attacker could exploit the issue
An attacker can trick the build process into sending a valuable access token to a registry they control. This happens when kaniko, a container image builder, uses a credential helper that incorrectly trusts hostnames. A specially crafted Dockerfile can cause kaniko to authenticate to a malicious registry, exposing Azure Resource Manager credentials that can then be used to access other cloud resources.
- No prior access required.
- Dockerfile referencing a fake registry.
- Exposure of sensitive cloud credentials.
Live Threat
Current exploitation, exposure, and threat context
kaniko could leak Azure Active Directory access tokens to an attacker if it interacts with a lookalike Azure Container Registry host during image building. These tokens, once compromised, could be used to access Azure Resource Manager and any other Azure Container Registries the associated identity has permissions for.
- Azure AD access tokens at risk.
- Token sent to attacker-controlled host.
- Unauthorized access to Azure resources.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts systems using kaniko for container image builds, specifically when interacting with Azure Container Registry. The primary responsibility for addressing this lies with teams managing CI/CD pipelines and container build environments, often platform or infrastructure teams, in coordination with security teams to assess exposure. The first practical step is to identify all kaniko build instances, confirm if they use Azure credentials, and then determine the criticality of affected build pipelines before planning remediation.
- Platform or CI/CD teams own the fix.
- Verify Azure credential usage in kaniko builds.
- Plan remediation based on identified exposure.
