Kubernetes Helm charts can expose data without users ever knowing

Credit: The original article is published here.

  • Microsoft security blog warns Kubernetes users about Helm charts with default settings
  • These settings often come with open ports, weak credentials, and other risks
  • Microsoft is urging Kubernetes users to review their settings

Kubernetes Helm charts can expose data without users ever knowing, Microsoft security researchers have warned, urging Kubernetes users to be careful and review the default configuration of their Helm charts.

Kubernetes is an open source platform for automating the deployment, scaling, and management of containerized applications. Helm, on the other hand, is a package manager that simplifies the deployment and management of applications on Kubernetes using pre-configured templates called charts.

It allows users to define, install, and upgrade complex Kubernetes applications with minimal manual configuration.

Get Keeper Personal for just $1.67/month, Keeper Family for just $3.54/month, and Keeper Business for just $7/month

​Keeper is a cybersecurity platform primarily known for its password manager and digital vault, designed to help individuals, families, and businesses securely store and manage passwords, sensitive files, and other private data.

It uses zero-knowledge encryption and offers features like two-factor authentication, dark web monitoring, secure file storage, and breach alerts to protect against cyber threats.

Preferred partner (What does this mean?)View Deal

Default configurations

In a new blog post, titled “The risk of default configuration: How out-of-the-box helm charts can breach your cluster,” authors Michael Katchinskiy, and Yossi Weizman argued that in many cases, Helm charts require no authentication, keep certain ports open, and use easy-to-guess, or hardcoded passwords.

This happens when Helm charts are deployed with default settings, which is often the case with inexperienced cloud users.

“Default configurations that lack proper security controls create a severe security threat,” the blog reads. “Without carefully reviewing the YAML manifests and Helm charts, organizations may unknowingly deploy services lacking any form of protection, leaving them fully exposed to attackers.”

Katchinskiy and Weizman added that the risk is “particularly concerning” when the deployed apps can query sensitive API, or allow administrative actions.”

They singled out three cases where Helm charts put entire Kubernetes environments at risk – Apache Pinot, Meshery, and Selenium Grid.

The best way to mitigate the risk is to be careful when deploying Helm, not use default configurations, and evaluate the setup from a security perspective to make sure it includes authentication and network isolation.

Furthermore, Microsoft recommends users run regular scans for misconfigurations that can expose interfaces to the public, and keep a close eye on containers for unwarranted activity.

Via BleepingComputer

You might also like