The Journey From Isolated Container to Cluster Admin
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Summary
The Architecture of Microsoft Service Fabric
Microsoft Service Fabric is an enterprise-grade distributed systems platform and container orchestrator powering critical Microsoft Azure cloud infrastructure and internal services.
Discovering the FabricEscape Container Escape Vulnerability
Aviv Sasson dissects the FabricLifecycleWorkflowManager component, identifying race conditions and unvalidated path traversals in container deployment processes.
Escalating from Container to Full Host and Node Admin
Sasson demonstrates weaponizing the flaw to break out of Linux container sandboxes, execute code on host nodes, and harvest cluster management certificates.
Remediation and Cloud Multi-Tenant Hardening
The author discusses Microsoft's coordinated patch deployment (CVE-2022-30137) and strategies for hardening multi-tenant container orchestration architectures.
Related talks
Main Stage·43 min
Aviv Sasson
Aviv Sasson presents the complete technical breakdown of FabricEscape (CVE-2022-30137), breaking out of Linux containers to seize full Azure Service Fabric cluster control.
Main Stage·42 min
Dirk-jan Mollema
Demonstrates a complete Azure Active Directory attack chain from initial access through Global Administrator privilege escalation.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.