Kubernetes RBAC Misconfiguration Detection

k8s-rbac-misconfiguration is a critical severity check in the devops category, written in go. Its source is templates/devops/kubernetes/k8s-rbac-misconfiguration.go in cert-x-gen-templates.

What it checks

Detects Kubernetes RBAC misconfigurations including unauthenticated API server access on insecure port 8080, anonymous authentication on port 6443 with strict TLS, dangerous ClusterRoleBindings enabling privilege escalation to cluster-admin, and exposed Kubernetes Dashboard on port 8001 or 443.

Header

Field	Value
Id	k8s-rbac-misconfiguration
Severity	critical
Language	go
Category	devops
Author	BugB Technologies
Template version	not recorded
Confidence	95
CVSS	not recorded
Weakness	CWE-269
Tags	kubernetes, rbac, privilege-escalation, misconfiguration, anonymous-auth, cluster-admin, api-server, dashboard, k8s
Target kind	not recorded
Oracle	not recorded

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://kubernetes.io/docs/reference/access-authn-authz/rbac/
• https://kubernetes.io/docs/reference/access-authn-authz/authentication/#anonymous-requests
• https://attack.mitre.org/techniques/T1078/
• https://github.com/kubernetes/dashboard

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info k8s-rbac-misconfiguration

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• devops is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.