CVE-2024-31463 Ironic-image allows unauthenticated local access to Ironic API
Attackers with local pod access can bypass authentication to modify bare-metal machines when reverse proxy mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-31463?
CVE-2024-31463 is a medium-severity authentication bypass vulnerability in metal3-io ironic-image, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` variable set to `true`, 1) HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2) Ironic listens in host network on a private port 6388 on localhost by default. As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication. A similar problem affects Ironic Inspector (`INSPECTOR_REVERSE_PROXY_SETUP` set to `true`), although the attack potential is smaller there. This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the `IRONIC_PRIVATE_PORT` variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings. This vulnerability is fixed in 24.1.1.
Weakness: CWE-288
Which versions are affected by CVE-2024-31463?
How do I fix CVE-2024-31463?
No fix has been published for CVE-2024-31463 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-31463 being exploited?
There is no known exploitation of CVE-2024-31463 in the wild and no public exploit code.
Sources
Also known as GHSA-g2cm-9v5f-qg7r.