Lighthouse MITM via EndpointSlice IP Spoofing in Red Hat ACM

Executive Summary

This vulnerability is in the Lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. It involves insufficient validation of IP addresses in EndpointSlice objects. A compromised spoke cluster can inject malicious IP addresses, causing other clusters' Lighthouse DNS to redirect legitimate service traffic to attacker-controlled endpoints. This enables Man-in-the-Middle (MITM) attacks on cross-cluster service communications.

Useful 0 Not Useful 0

Detection Guidance

Monitor EndpointSlice objects in your Kubernetes clusters for unexpected IP addresses, especially those outside expected CIDR ranges. Check DNS logs for unusual resolution patterns pointing to malicious endpoints. Use commands like kubectl get endpointslices -A to inspect EndpointSlice objects and kubectl get svc -o wide to verify service IPs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to intercept and manipulate cross-cluster service communications. It can lead to unauthorized information disclosure and data manipulation without modifying the target service. Attackers can redirect traffic to malicious endpoints, enabling espionage or service disruption in multi-cluster Kubernetes environments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR and HIPAA by enabling unauthorized data access and manipulation. GDPR mandates protection of personal data, while HIPAA requires safeguards for health information. MITM attacks exploiting this flaw may lead to data breaches, resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Isolate compromised spoke clusters immediately to prevent further exploitation. Review and restrict cross-cluster DNS resolution permissions. Monitor network traffic for MITM attempts and update Red Hat Advanced Cluster Management for Kubernetes once patches are available.

Useful 0 Not Useful 0