EKS Auth Bug Let Attackers Inject Fake Kubernetes Identities via Parameter Pollution

·2 views

A vulnerability in Amazon EKS's aws-iam-authenticator allowed attackers to manipulate Kubernetes usernames by exploiting an HTTP parameter pollution flaw in how access key IDs were parsed. The authenticator extracted the AccessKeyID from client-supplied URL query parameters rather than from the verified AWS STS response, meaning an attacker could supply a duplicate, case-variant credential parameter to make the two parsers disagree on which value to use. As a result, AWS would authenticate the request under a victim's identity while the cluster assigned a Kubernetes username derived from the attacker's key, effectively decoupling AWS-side authentication from cluster-side identity. The flaw, disclosed as Kubernetes HackerOne report 1580493, was remediated by replacing the {{AccessKeyID}} template substitution with {{SessionName}}, a value sourced entirely from the STS response that the client cannot influence. Administrators can further harden configurations by switching to ARN-based identity mappings, which rely solely on server-derived, signed values and eliminate client-controlled input from the identity layer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CauterRule v0.2.0: Specific AI Agent Rules Still Fire on Successful Runs

CauterRule, an open-source tool that converts repeated AI agent failures into reusable standing rules, released version 0.2.0 after testing four models across 745 trajectories. The system successfully kept generic trigger rates below 5.6%, well under its 10% target, with most triggers precisely naming tools and error conditions such as 'git push fails with non-fast-forward'. However, 6 of 10 golden test scenarios remained inconclusive because these specific triggers also matched clean, successful runs — meaning they could disrupt working workflows if promoted. The replay engine flagged all six as ambiguous evidence, unable to safely approve or reject them. The findings highlight a core challenge: a trigger can accurately describe a failure condition while still being too broad in terms of when it actually fires.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Builds Database Schema Using Team Glossary, Never Naming a Column

A software developer demonstrated how an AI agent can generate a full relational database schema without manually specifying a single column name, by binding it to a pre-defined team word list and domain dictionary. The agent resolved logical business terms like 'Post Content' and 'Delete Flag' into standardized physical names using the team's own abbreviations, ensuring consistency across all tables. Even complex structures like self-referencing foreign keys were handled through naming rules in the shared glossary rather than ad-hoc decisions. When the agent encountered an unregistered word, it flagged a lint warning and submitted a vocabulary proposal for human approval instead of inventing an abbreviation on its own. The author argues this human-in-the-loop, standards-driven approach is what separates a reliable AI assistant from an unpredictable one when it comes to data modelling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

6 Python Libraries a Developer Relies on Every Time for Stock Market Data

A developer writing for DEV Community shared six Python libraries they consistently use when working with financial and stock market data, built through years of trial and error. Pandas is highlighted as essential for time-series manipulation, such as resampling minute-level price data to hourly intervals, with a key warning that timestamps must be set as the index before using the resample function. NumPy is recommended for vectorized numerical operations like return and volatility calculations, though the author cautions that unhandled NaN values can silently corrupt entire results. The CCXT library is praised for unifying the APIs of dozens of exchanges into a single interface, making it easy to switch between platforms without rewriting code. The article emphasizes practical, real-world usage over theory, noting specific mistakes and the fixes that saved hours of debugging.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vim Search Commands Explained: Navigate Large Files Faster Without Arrow Keys

Vim offers two core search families that help developers move through code efficiently without manual line-by-line scrolling. Single-line navigation uses commands like f, F, t, and T to jump to or just before specific characters on the current line. For file-wide searches, the slash (/) and question mark (?) commands let users jump directly to any matching text across hundreds of lines. Pressing n and N repeats the search forward or backward, while * and # quickly find other occurrences of the word under the cursor. Mastering these commands turns search into a primary movement tool, reducing the need for repetitive keystrokes in large codebases.

0 comments Read more at DEV Community