Root Access Exploit Threatens SPIFFE/SPIRE Machine Identity Systems

Research from Unit 42 reveals that attackers with root access on Kubernetes nodes can exploit SPIFFE/SPIRE systems to impersonate workloads and harvest SVIDs. This vulnerability arises from the assumption that the node is trusted, which collapses once root access is gained. The technique, which has not yet been observed in the wild, allows attackers to spoof cgroup information used during workload attestation. Unit 42 has developed an open-source tool named Spooffe to help defenders assess their exposure to this threat. Organizations are advised to prohibit privileged containers and minimize reliance on weak selectors to mitigate risks. The SPIFFE framework is widely used to manage workload identities in cloud-native environments, making this a significant concern for affected organizations.

Key Points: • Attackers with root access can exploit SPIFFE/SPIRE to impersonate workloads. • The technique allows harvesting of SVIDs, compromising machine identity systems. • Unit 42 developed Spooffe, a tool for assessing exposure to this vulnerability.