azure-aks-run-command-modifycode

runCommand/action can kubectl-apply attacker manifests - new/patched Deployments - changing what code runs as each workload identity.

derived azure emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`KubernetesWorkload`
source	`?principal`
target	`<any KubernetesWorkload within ?cluster>`
permissions	`Microsoft.ContainerService/managedClusters/runCommand/action`
conditions	`service_state`
state logic	inherit from the contributing CanExecuteCommand (azure-aks-run-command): ACTIVE when the cluster is running; CONDITIONAL(service_state) when stopped; BLOCKED when the CanExecuteCommand is BLOCKED.

source type

Identity

target type

KubernetesWorkload

source

?principal

target

<any KubernetesWorkload within ?cluster>

permissions

Microsoft.ContainerService/managedClusters/runCommand/action

conditions

service_state

state logic

inherit from the contributing CanExecuteCommand (azure-aks-run-command): ACTIVE when the cluster is running; CONDITIONAL(service_state) when stopped; BLOCKED when the CanExecuteCommand is BLOCKED.

Narrative

{principal.name} can run kubectl apply via runCommand on cluster {target.name}, injecting attacker-controlled container specs into new or existing workloads.

Raw rule rules/derived/azure/aks.yaml

id: azure-aks-run-command-modifycode
emits: CanModifyCode
description: "runCommand/action can kubectl-apply attacker manifests \u2014 new/patched Deployments \u2014\
  \ changing what code runs as each workload identity."
match:
- - principal: null
  - CanExecuteCommand
  - cluster: null
where:
- node_type(?cluster) == KubernetesCluster
- ?principal's CanExecuteCommand on ?cluster was produced by azure-aks-run-command (runCommand/action)
emit:
  source_type: Identity
  target_type: KubernetesWorkload
  source: ?principal
  target: <any KubernetesWorkload within ?cluster>
  permissions:
  - Microsoft.ContainerService/managedClusters/runCommand/action
  conditions:
  - service_state
  state_logic: 'inherit from the contributing CanExecuteCommand (azure-aks-run-command): ACTIVE when the
    cluster is running; CONDITIONAL(service_state) when stopped; BLOCKED when the CanExecuteCommand is
    BLOCKED.'
  confidence: 0.95
  derived_from:
  - <CanExecuteCommand edge_id (azure-aks-run-command)>
  false_positive_note: "CanModifyCode on the cluster represents the ability to inject arbitrary pod manifests\
    \ via kubectl apply.  The fan-out (which workloads are affected) is determined by which workloads\
    \ the attacker targets with their manifest \u2014 in practice, any KubernetesWorkload in the cluster.\
    \  The can-execute-as execute-as-via-code-modify linchpin then produces CanExecuteAs for each workload's\
    \ identity.  Do not double-count with azure-aks-run-command-executes-as on the same (principal, identity)\
    \ pair."
  narrative: '{principal.name} can run kubectl apply via runCommand on cluster {target.name}, injecting
    attacker-controlled container specs into new or existing workloads.'