# Defeating Kubernetes Privilege Escalation: A Cloud Detection & Response Case Study

Attacker exploited an RCE CVE in an internet-exposed open-source app on EKS, reached IMDS from the pod, and stole the EC2 instance IAM role to recon AWS.

- Payout: Real-world hack
- Severity: high
- Program: EKS
- Analysis by: Wiz Research
- Disclosed: 2024-08-21
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/defeating-kubernetes-privilege-escalation-a-cloud-detection-response-case-study
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-defeating-kubernetes-privilege-escalation-a-cloud-detection-response-case-study
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:incident platform:threat-intel sev:high tech:aws tech:kubernetes vuln:misconfiguration vuln:privilege-escalation vuln:rce

**Target:** EKS pod on EC2 host with IMDS reachable; open-source app with RCE CVE
**Root cause:** Default EKS configuration allowed pods to reach the host EC2 Instance Metadata Service (IMDS), so code execution in a pod yielded the node's IAM role credentials. An internet-facing service was deployed to the same subnet, causing the shared Security Group to be modified.
**Steps:**
1. Deploy internet-facing service to the same subnet as the vulnerable open-source app, modifying the shared Security Group
2. Exploit the RCE CVE to gain code execution in the EKS pod
3. From the pod, query the host IMDS endpoint to retrieve the EC2 instance IAM role credentials
4. Use the stolen role from an irregular source IP to query multiple EC2 instances and Security Groups
**How found:** Defenders flagged an EC2 instance IAM role used from an irregular source IP plus recon queries against multiple EC2 instances and Security Groups; inventory baselines identified the role as belonging to an EKS pod, prompting triage of CloudTrail, VPC Flow logs and host forensics.
**Exploitation:** A presumed internet scan exploited the RCE CVE in the exposed open-source app, gaining pod-level execution. Because IMDS was reachable, the attacker pulled the node's IAM role credentials and used them externally for reconnaissance across EC2 and Security Groups until defenders detected and contained the activity.
**Escalation:** Pod code execution escalated to control of the EC2 instance IAM role, then to cloud-wide reconnaissance of EC2 and Security Groups.
**Insight:** Baseline which IAM roles belong to EKS pods versus other compute; a pod role suddenly enumerating EC2/Security Groups or used from an external IP is a strong IMDS-theft signal worth alerting on.