Xlera8

Cyber Security

Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns

Time Stamp: April 17, 2024 3:14 PM
Source Node: 2731801

Republished By Plato

Known vulnerabilities in OpenMetadata’s open source metadata repository have been under active exploit since the beginning of April, allowing threat actors to launch remote code execution cyberattacks against unpatched Kubernetes clusters, according to research from Microsoft Threat Intelligence.

OpenMetadata is an open source platform that operates as a management tool as well as a central repository for metadata. In mid-March, researchers published information on five new vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254) that affected versions preceding v1.3.1, according to Microsoft’s report.

And while many cybersecurity teams might have missed the advisory, adversaries picked up on the opportunity to break into vulnerable Kubernetes environments and leverage them for cryptocurrency mining, the vendor said.

“In this case, a vulnerable Kubernetes workload which is exposed to the Internet got exploited,” Microsoft researcher Yossi Weizman explains. While the cybercriminals were engaged in crypto mining, he warns there’s a wide range of nefarious activity an adversary can engage in once they’re inside a Kubernetes cluster.

“In general (not specifically in this case), once attackers have control over a workload in the cluster, they can try to leverage this access also for lateral movement, both inside the cluster and also to external resources,” Weizman adds.

OpenMetadata administrators are advised to update, use strong authentication, and reset any default credentials in use.

SEO Powered Content & PR Distribution. Get Amplified Today.
PlatoData.Network Vertical Generative Ai. Empower Yourself. Access Here.
PlatoAiStream. Web3 Intelligence. Knowledge Amplified. Access Here.
PlatoESG. Carbon, CleanTech, Energy, Environment, Solar, Waste Management. Access Here.
PlatoHealth. Biotech and Clinical Trials Intelligence. Access Here.
Source: https://www.darkreading.com/cloud-security/active-kubernetes-rce-attack-relies-on-known-openmetadata-vulns

Tags: 1, 2024, a, access, According, active, activity, actors, Adds, administrators, advised, advisory, affected, against, Allowing, also, an, and, any, April, ARE, AS, Attack, attackers, Authentication, been, Beginning, both, break, CAN, case, central, cluster, Clusters, code, code execution, control, Credentials, crypto, crypto mining, cryptocurrency, Cryptocurrency Mining, cve, cyberattacks, cybercriminals, Cybersecurity, default, engage, engaged, environments, Execution, Explains, Exploit, exploited, exposed, external, Five, For, from, General, got, Have, he, in, information, inside, Intelligence, Internet, into, Is, known, Kubernetes, launch, Leverage, management, many, March, metadata, metadata repository, Microsoft, mid, Might, Mining, missed, movement, new, of, on, once, open, open source, operates, Opportunity, Over, Picked, platform, plato, Plato Data Intelligence, PlatoData, preceding, published, range, RCE, RE, relies, remote, remote code execution, report, repository, research, researcher, researchers, reset, Resources, s, Said, since, source, specifically, strong, Teams, that, The, Them, There, they, They're, this, threat, threat actors, threat intelligence, to, tool, try, under, unpatched, up, Update, use, v1, vendor, versions, Vulnerabilities, Vulnerable, Warns, WELL, were, Which?, while, wide, Wide Range, workload, zephyrnet

Xlera8

Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns

Republished By Plato

Scientists Find a Surprising Way to Transform A and B Blood Types Into Universal Blood

Chat with us