Listen to this Post
The vulnerability exploits LXD’s API acceptance of `text/plain` and `application/x-www-form-urlencoded` Content-Types for JSON requests, bypassing CSRF protections. Client certificate authentication, unlike cookies, is not bound by SameSite restrictions. An attacker can craft a malicious HTML form that, when visited by an authenticated user, automatically submits a request to the LXD API. Because the form submission is a “simple request,” the browser sends the client certificate, authenticating the request. The LXD API then parses the form-submitted text as JSON, executing the attacker’s command, such as creating and starting a new container instance, leading to unauthorized access and potential command execution via cloud-init.
Platform: LXD
Version: <6.5, <5.21.4
Vulnerability: CSRF
Severity: Critical
date: 2024
Prediction: 2024-05-15
What Undercode Say:
curl -k -X POST --cert client.crt --key client.key https://lxd-host:8443/1.0/instances -H "Content-Type: application/json" -d '{"name":"test-container", "source": {"type":"image", "alias":"24.04"}}'
<
form enctype="text/plain" method="POST" action="https://lxd-host:8443/1.0/instances">
<input name='{"name":"csrf-pwn","source":{"type":"image","alias":"24.04"}'">
</form>
How Exploit:
Malicious HTML form triggers unauthorized instance creation using victim’s client certificate.
Protection from this CVE
Enforce `Content-Type: application/json` header validation. Update to LXD 6.5, 5.21.4, or 5.0.5.
Impact:
Unauthorized container creation and potential remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
