Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3.
When the reverse proxy mode is enabled by the IRONIC_REVERSE_PROXY_SETUP
variable set to true
:
- HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself.
- Ironic listens in host network on a private port 6388 on localhost by default.
As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication.
A similar problem affects Ironic Inspector (INSPECTOR_REVERSE_PROXY_SETUP
set to true
), although the attack potential is smaller there.
Impact
This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the IRONIC_PRIVATE_PORT
variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings.
Patches
Workarounds
Two different workarounds are possible:
- Switch to using unix sockets for traffic between HTTPD and Ironic/Inspector (recommended). Set the variables
IRONIC_PRIVATE_PORT
and IRONIC_INSPECTOR_PRIVATE_PORT
to the value unix
.
- Temporarily stop using the reverse proxy mode (set
IRONIC_REVERSE_PROXY_SETUP
and INSPECTOR_REVERSE_PROXY_SETUP
to false
).
Using the workaround may require Baremetal Operator reconfiguration, depending on the deployed Metal3 configuration. See referenced pull requests.
References
Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3.
When the reverse proxy mode is enabled by the
IRONIC_REVERSE_PROXY_SETUP
variable set totrue
:As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication.
A similar problem affects Ironic Inspector (
INSPECTOR_REVERSE_PROXY_SETUP
set totrue
), although the attack potential is smaller there.Impact
This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the
IRONIC_PRIVATE_PORT
variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings.Patches
Workarounds
Two different workarounds are possible:
IRONIC_PRIVATE_PORT
andIRONIC_INSPECTOR_PRIVATE_PORT
to the valueunix
.IRONIC_REVERSE_PROXY_SETUP
andINSPECTOR_REVERSE_PROXY_SETUP
tofalse
).Using the workaround may require Baremetal Operator reconfiguration, depending on the deployed Metal3 configuration. See referenced pull requests.
References