Add "nodes/proxy" as a risky permission

[Christophe Tafani-Dereeper]

Hello!

nodes/proxy permission allow an attacker to proxy Kubelet requests through any node, compromising the whole cluster. See https://blog.aquasec.com/privilege-escalation-kubernetes-rbac

It would be great to add it to the list of dangerous permissions!

[Eviatar Gerzi]

Hi, thanks for the suggestion :)
I added it like that:

# Risk: Privilege Escalation from Node/Proxy
# Verb: get, create
# Resources: nodes/proxy

- kind: Role
  metadata:
    namespace: default
    name: risky-execute-command-node-proxy
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["nodes/proxy"]
    verbs: ["get", "create"]

If some rule have these two verbs get and create on nodes/proxy, it will assign it as risky.
I wonder maybe I should also add, as a low priority, risky rule with only get, maybe I will add it in the future.

[Christophe Tafani-Dereeper]

Great!!

[Christophe Tafani-Dereeper]

cc @raesene

[Rory McCune]

Nice! Yeah get on nodes/proxy as a low risk would make sense to me. It does allow things like pulling pod lists via the Kubelet API bypassing auditing but it's not (AFAIK) too serious