ABI Bootstrap CSR Approval Privilege Escalation

Executive Summary

During the bootstrap process of a system, a service called approve-csr.service approves and signs every Certificate Signing Request (CSR) without verifying the identity of the requester. This allows an attacker on the installation network to retrieve an unauthenticated Ignition file, extract a limited kubeconfig, submit a CSR for admin access, receive a signed certificate, and gain full cluster-admin privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to ports 22623 or 22624 during the bootstrap phase. Monitor CSR submissions for CN=system:admin and verify if certificates are issued without proper validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain complete control over the cluster, allowing them to manipulate or steal data, disrupt services, or perform unauthorized actions. This is only possible during the brief bootstrap window when the system is being set up.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized full cluster-admin access during the bootstrap phase, which could lead to unauthorized data access, modification, or exfiltration. This violates compliance requirements for data protection and access controls in standards like GDPR and HIPAA, as it undermines secure authentication and authorization mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to ports 22623 and 22624 during bootstrap. Implement strict CSR validation policies. Ensure the bootstrap window is minimized and monitored closely.

Useful 0 Not Useful 0