Leadership Hijacking in Docker Swarm and Its Consequences

With the advent of microservice-based software architectures, an increasing number modern cloud environments and enterprises use operating system level virtualization, which is often referred to as container infrastructures. Docker Swarm one most popular orchestration infrastructures, providing high availability fault tolerance. Occasionally, discovered escape vulnerabilities allow adversaries execute code on host operate within infrastructure. We show that currently not secured against misbehaving manager nodes. This allows a impact, probability privilege escalation attack, we refer leadership hijacking, possibility neglected by current security literature. Cloud lateral movement defense evasion payloads adversary leverage functionality control each every in underlying cluster. demonstrate end-to-end with access application running cluster achieves full To reduce successful impact infrastructures must trust participating nodes and, particular, incorporate immune leader election algorithms.