Azure SSRF via Unvalidated VaultName in Kroxylicious KMS Provider

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Azure Key Vault KMS provider of Kroxylicious. It occurs when the provider accepts an untrusted vaultName from wire-deserialized Encrypted Data Encryption Keys (EDEK) bytes without proper format validation. This allows an attacker to exfiltrate the proxy's Azure bearer token to a host they control and replay the token against the real Key Vault, defeating the record-encryption trust model.

Useful 0 Not Useful 0

Detection Guidance

Monitor outbound network traffic from the Kroxylicious proxy pods to detect unexpected connections to Azure Key Vault endpoints. Check logs for Key Management Service (KMS) calls targeting unusual vault hostnames or IP addresses. Use network policies to log or block unauthorized egress attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal your Azure bearer token and use it to access your Key Vault, decrypting sensitive data. They might also bypass security controls to access internal systems or exfiltrate data. The impact includes high confidentiality and integrity risks with no availability impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It undermines encryption trust models, potentially causing non-compliance with data confidentiality and integrity mandates.

Useful 0 Not Useful 0

Mitigation Strategies

• Bind all topics to Key Encryption Keys (KEKs) and remove unencrypted passthrough policies to prevent token exfiltration.
• Restrict outbound network access using Kubernetes NetworkPolicy to allow egress only to legitimate Azure Key Vault endpoints on port 443.
• Monitor KMS call patterns by alerting on unwrap requests targeting unexpected vault hostnames to detect potential attacks.

Useful 0 Not Useful 0