Full Report
Researchers observed attackers exploiting critical vulnerabilities in the OpenMetadata platform to infiltrate Kubernetes environments for cryptomining. OpenMetadata, an open-source platform for managing data source metadata, was found to have several vulnerabilities (CVE-2024-...
Analysis Summary
# Incident Report: OpenMetadata Exploitation for Cryptomining
## Executive Summary
Threat actors exploited a chain of critical vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28848, CVE-2024-29032, and CVE-2024-29861) in the OpenMetadata platform to gain unauthorized entry into Kubernetes environments. Once inside, the attackers leveraged administrative privileges to install XMRig miners for Monero cryptocurrency extraction. Microsoft researchers identified the campaign, noting that the primary goal was illicit resource utilization via container escape and lateral movement.
## Incident Details
- **Discovery Date:** April 2024
- **Incident Date:** March – April 2024
- **Affected Organization:** Multiple organizations utilizing OpenMetadata
- **Sector:** Technology, Data Management
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 2024
- **Vector:** Exploitation of broken access control and authentication bypass in OpenMetadata.
- **Details:** Attackers targeted versions prior to 1.3.1, using unauthenticated API requests to trigger SpEL (Spring Expression Language) injection vulnerabilities.
### Lateral Movement
- Attackers leveraged the Kubernetes service account tokens associated with the OpenMetadata container to interact with the API server and identify other accessible resources within the cluster.
### Data Exfiltration/Impact
- No significant data exfiltration was reported; the primary impact was the consumption of compute resources for unauthorized cryptomining.
### Detection & Response
- **How it was discovered:** Microsoft Defender for Cloud identified suspicious container activities and unauthorized mining processes.
- **Response actions taken:** Security patches were released by the OpenMetadata maintainers; affected containers were isolated and remediated by users tracking the advisory.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2024-28255 and related vulnerabilities in the OpenMetadata login/API flow.
- **Persistence:** Implementation of cron jobs and deployment of malicious "k8s" titled containers within the Kubernetes cluster.
- **Privilege Escalation:** Use of the OpenMetadata service account to gain elevated permissions within the namespace.
- **Defense Evasion:** Use of legitimate-sounding process names; clearing logs; and hosting malicious scripts on remote servers (e.g., `github.com`) to hide the origin of the payload.
- **Credential Access:** Extraction of environment variables and Kubernetes secrets from the compromised container.
- **Discovery:** Scanning for network configurations and checking for the presence of security monitoring tools.
- **Lateral Movement:** Using Kubernetes API tokens to pivot to other pods.
- **Collection:** N/A (Focused on resource hijacking).
- **Exfiltration:** N/A.
- **Impact:** Resource exhaustion via XMRig cryptomining; increased cloud infrastructure costs.
## Impact Assessment
- **Financial:** Increased operational costs due to high CPU/GPU consumption in cloud environments.
- **Data Breach:** Exposure of metadata configurations and service account tokens.
- **Operational:** Potential degradation of legitimate data management services and cluster stability.
- **Reputational:** Risk to organizations for failing to patch critical open-source dependencies.
## Indicators of Compromise
- **Network indicators:**
- `194[.]38[.]20[.]180`
- `109[.]122[.]200[.]60`
- `kakeru[.]manakai[.]org`
- **File indicators:**
- `64-linux-linux.tar.gz` (XMRig miner)
- `openmetadata[.]sh` (Malicious script)
- **Behavioral indicators:**
- Unexpected SpEL expression errors in OpenMetadata logs.
- High CPU usage originating from containers named `k8s-pod-xxxx`.
## Response Actions
- **Containment:** Isolation of compromised Kubernetes pods and revocation of associated service account tokens.
- **Eradication:** Deletion of malicious cron jobs and binary files installed on persistent volumes.
- **Recovery:** Upgrading OpenMetadata instances to version 1.3.1 or later.
## Lessons Learned
- **Key takeaways:** Critical vulnerabilities in specialized data platforms like OpenMetadata are attractive targets for automated exploitation.
- **What could have been done better:** Organizations should implement automated vulnerability scanning for containers and enforce the principle of least privilege for service accounts to prevent cluster-wide lateral movement.
## Recommendations
- **Patch Management:** Immediately update all OpenMetadata deployments to version 1.3.1+.
- **Network Security:** Restrict access to the OpenMetadata UI and API to authorized IP ranges only.
- **Monitoring:** Enable runtime security monitoring for Kubernetes (e.g., Microsoft Defender for Containers or Falco) to detect unauthorized process execution.
- **Hardening:** Use non-root users for container images and limit Kubernetes service account permissions using RBAC (Role-Based Access Control).