Researchers from Palo Alto’s Unit 42 have discovered a vulnerability dubbed “FabricScape” that impacts Microsoft Azure’s “Service Fabric.” The vulnerability, identified as CVE-2022-30137, allows Linux containers to escape and escalate privileges, gaining root privileges on the node and providing an opportunity to compromise all other nodes in the cluster. Service Fabric is a “distributed systems platform” that allows developers to easily “package, deploy, and manage scalable and reliable microservices and containers.” Service Fabric runs using Docker containers, a technology which normally does not allow containers to affect its host system. The vulnerability exists in the Data Collection Agent (DCA) component. The DCA is responsible for collecting logs on each container and storing them on the host machine. This means the DCA must run with root privileges to access the containers. As the logs can be modified from the container, certain vulnerabilities in the DCA could give root access to the host machine. The vulnerability allows arbitrary writes to files on the host machine using the function “GetIndex.” This function reads a file, verifies the format, modifies some data, then overwrites the file with the new data. If the file is swapped with a symlink, a Linux file that points to another file, the program follows the symlink and overwrites the destination file. While this would allow attackers to overwrite executable binaries, add SSH keys, or even create a new user, the initial file must be in a certain format to be written and is not granted execution permissions following the write. To gain code execution on the node, the researchers instead used a technique known as dynamic linker hijacking, an exploit that loads a shared library in a targeted process by changing an environment variable. Once the researchers took control of a node, they discovered sensitive certificate files that gave access to the entire cluster. Using this vulnerability, an attacker with access to a targeted organizations application can pivot to other applications owned by the organization. Microsoft has released a fix for the issue on June 14, 2022, and CTIX analysts recommend Azure administrators update to the latest version of Service Fabric or disable runtime access if updating is not possible.