CVE-2024-5321

What it actually does

Improper file permissions on Windows nodes allow BUILTIN\Users to read container logs and NT AUTHORITY\Authenticated Users to modify them, bypassing intended authorization controls for log files.

Why it matters to the business

Attackers with limited access on affected nodes can view sensitive application data in logs or alter records, complicating incident response and potentially exposing operational details.

How an attack unfolds

An attacker who obtains a low-privileged account on a Windows Kubernetes node enumerates log directories, reads container output files, or overwrites entries to hide activity or inject false data.

How to fix it

Upgrade Kubernetes to a version that enforces correct ACLs on Windows node log paths; restrict node access and apply least-privilege file permissions where possible.

How to confirm the fix worked

Verify that log directories deny read access to BUILTIN\Users and write access to NT AUTHORITY\Authenticated Users; test by attempting access from non-privileged accounts after upgrade.

Typical attack path

1. Obtain local user access on a Windows Kubernetes node via credential theft or misconfiguration
2. Locate container log directories without elevated privileges
3. Read log contents to extract sensitive information or modify files to tamper with records

How to detect it

Review Windows file access logs and Kubernetes node audit events for non-admin accounts reading or writing container log paths; correlate with user logon events on Windows nodes.

• Access to C:\var\log\pods or equivalent container log directories by non-system accounts
• Event ID 4663 with Object Name containing container log files and SubjectUserName not in privileged groups

What your security team should do

• Prioritize patching Windows nodes in Kubernetes clusters to restore proper log authorization
• Audit node access controls and limit who can log in to Windows hosts
• Monitor for unusual log file access patterns using host-based logging