Improper Restriction of Security Token Assignment

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CVE-2021-1677

Azure Active Directory Pod Identity Spoofing Vulnerability...

CVE-2021-1677

Azure Active Directory Pod Identity Spoofing Vulnerability...

Spoofing

Azure Active Directory Pod Identity Spoofing Vulnerability...

CVE-2021-1677

CVE-2021-1677 is described as an Azure Active Directory Pod Identity spoofing vulnerability affecting Azure Kubernetes Service. The connected documents indicate the issue arises from improper handling in the Pod Identity IMDS flow, enabling a malicious pod to obtain another pod’s credentials/toke...

CVE-2021-1677 Azure Active Directory Pod Identity Spoofing Vulnerability

...

Azure Active Directory Pod Identity Spoofing Vulnerability

...

PT-2021-1676 · Microsoft · Azure Active Directory

Name of the Vulnerable Software and Affected Versions: Azure Active Directory affected versions not specified Description: The issue is related to an information disclosure vulnerability in the Azure Active Directory Pod Identity service. It may allow an attacker to gain unauthorized access to...

Vulnerability fixed in Microsoft Azure Active Directory Pod Identity

There is a vulnerability in Azure Active Directory AAD Pod Identity. The vulnerability allows a malicious person to impersonate another user. The AAD pod identity allows users to assign identities to pods in Kubernetes clusters by querying them with regular Azure Instance Metadata Services IMDS...