The Journey From an Isolated Container to Cluster Admin in Service Fabric (Encore)
Aviv Sasson presents the complete technical breakdown of FabricEscape (CVE-2022-30137), breaking out of Linux containers to seize full Azure Service Fabric cluster control.
Summary
The Architecture of Microsoft Service Fabric Clusters
Microsoft Service Fabric serves as a critical distributed container orchestration platform hosting core internal services across Microsoft Azure data centers.
Deconstructing the FabricEscape Exploit Mechanics
Aviv Sasson walks through the technical discovery of unvalidated symbolic link traversals and race conditions within the container lifecycle management daemon.
Escalating from Low-Privilege Container to Full Host and Node Admin
Sasson demonstrates weaponizing the flaw to break out of Linux container sandboxes, execute code on host nodes, and harvest cluster management certificates.
Remediation and Multi-Tenant Security Best Practices
The author discusses the coordinated vulnerability disclosure timeline and security engineering takeaways for cloud container orchestrators.
Related talks
Main Stage·36 min
Aviv Sasson
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Main Stage·42 min
Dirk-jan Mollema
Demonstrates a complete Azure Active Directory attack chain from initial access through Global Administrator privilege escalation.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.