# #BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services

Wiz chained container privesc, PID-namespace lateral movement, and over-scoped registry credentials in Alibaba Cloud PostgreSQL services to reach cross-tenant data and enable supply-chain image overwrite.

- Payout: Research
- Severity: critical
- Program: Alibaba Cloud
- Credited: Wiz Research
- Disclosed: 2023-04-19
- Write-up quality: 9/10
- Original: https://www.wiz.io/blog/brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r
- Tags: domain:cloud impact:data-leak impact:internal-access kind:research platform:threat-intel sev:critical tech:docker tech:kubernetes technique:chained vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** ApsaraDB RDS and AnalyticDB for PostgreSQL managed containers, K8s nodes, private container registry
**Root cause:** Multi-tenant K8s pods shared PID namespaces and writable home mounts between DB and operational containers; kubelet service account and registry pull credentials were over-privileged (write/push), and node images leaked secrets.
**Steps:**
1. AnalyticDB: cron `/etc/cron.d/tsar` runs `/usr/bin/tsar` as root; binary loads `/u01/adbpg/lib/libgcc_s.so.1` writable by adbpgadmin; overwrite with SUID-copying shared lib via PatchELF to get root
2. Trigger SSL-enable in portal to spawn scp/ssh in a neighboring container sharing PID namespace; read its fs via `/proc/{pid}/root/`
3. Home dir `/home/adbpgadmin` shared; write `~/.ssh/config` with `LocalCommand` to execute code in second container on next SSH spawn
4. Second container privileged with `/run/docker.sock`; spawn persistent privileged container sharing host namespaces and `/mnt` to escape to K8s node
5. Use kubelet credentials via kubectl to list pods/secrets; extract `docker-image-secret` imagePullSecret
6. Test registry creds: write/push allowed, enabling overwrite of other services' images
7. ApsaraDB: symlink `/data/pg_hba.conf` to target file; trigger revocation-list update so `sed -i` copies second container's file into shared path, disclosing source
8. Audit disclosed code: `install_user` from `select rolname from pg_authid where oid=10` injected into root command line; `ALTER ROLE "alicloud_rds_admin" RENAME TO "\`id\`"` then run upgrade check
9. In privileged check container overwrite `/proc/sys/kernel/core_pattern` with base64 reverse shell; crash process via `kill -11 $$` to get host root shell
**How found:** Recon of container filesystem found root cronjob loading writable shared lib; portal actions (SSL enable) spawned processes with paths absent locally, hinting at shared PID namespace; /proc/{pid}/root confirmed second container; shared home mount suggested SSH config injection. For RDS, a stray `/tmp/tools_log/docker_tools.log` revealed sed -i operations on shared pg_hba.conf, leading to symlink file-read primitive and source audit.
**Exploitation:** Starting from code execution in a customer PostgreSQL container (via prior PostgreSQL bugs), escalate to root, pivot through shared PID namespace and shared home mount into a privileged operational container, abuse docker.sock to spawn a host-namespace container, reach K8s API with kubelet creds, harvest registry imagePullSecret, and push malicious images to the shared private registry for supply-chain RCE across Alibaba database services.
**Escalation:** Container root -> PID-namespace lateral movement -> privileged container -> docker.sock host escape -> kubelet creds cross-tenant pod access -> registry write for supply-chain compromise; ApsaraDB path used symlink file disclosure -> source audit -> command injection -> core_pattern escape.
**Insight:** Portal-triggered management operations spawn short-lived helper containers; watch for processes with paths not in your container (shared PID namespace) and shared writable home mounts, then abuse SSH LocalCommand or sed -i symlink tricks to cross into them.