UNAUTHENTICATED CLUSTER TAKEOVER IN AWS ROSA

Summary from the TLDR InfoSec newsletter

A security researcher discovered a critical vulnerability in the Red Hat OpenShift Service affecting AWS ROSA Classic clusters that could allow unauthenticated full cluster takeover. The vulnerability lies in the cluster transfer endpoint, which checks only whether the recipient has the ability to accept a cluster, not whether the requester owns the cluster, allowing an attacker to take over a cluster with only the cluster_uuid and username. Unauthenticated requests to the cluster's web console settings endpoint return the cluster_uuid and the owner's email address, which could be used to guess their username.