What is going on at Azure?! First the Cosmos DB vulnerability [1] three weeks ago and now this?! It’s starting to look like a systemic issue at Microsoft. tl;d

What is going on at Azure?! First the Cosmos DB vulnerability [1] three weeks ago and now this?! It’s starting to look like a systemic issue at Microsoft. tl;dr - Microsoft uses an old version of runc (from 20216), with known vulnerabilities. runc is a container runtime. Researchers, using work from 2019, were able to break out of the container into the Kubernetes node. - Microsoft, to fix a known vulnerability (instead of patching!) in Kubernetes with `kubectl exec` has a custom solution (`bridge-pod`) that handles sending `kubectl exec` commands to nodes. - In Microsoft's custom solution, the HTTP request to run `kubectl exec` on the node sent from `bridge-pod` includes an access token with overly broad privileges in the header (not necessary in this case). If you monitor traffic once you've escape the container on the node, you can extract this access token if you send a command to your own container from the Azure CLI. - Access token grants `pod/exec` rights to anything in the cluster The egregious part is the `bridge-pod` and it's implementation. This wasn't just outdated software left unpatched, it was badly implemented hacks to work around their inability to patch. 1 - https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-a...