Listen to this Post
The vulnerability exists in the LXD `/1.0/images` API endpoint, which is configured as an “AllowUntrusted” interface requiring no authentication. When an unauthenticated user sends an HTTP GET request to this endpoint with a `project` parameter, the system’s response varies based on the project’s existence. If the specified project does not exist, the `projectutils.ImageProject` function returns an error that propagates as a 404 (Not Found) status code. Conversely, if the project exists but the unauthenticated user lacks permission to view it, the `imagesGet` function returns a 403 (Forbidden) error. This discrepancy in HTTP status codes allows an attacker to map and confirm the existence of projects on the system by observing whether a 404 or 403 error is returned for a given project name.
Platform: LXD
Version: <6.5, <5.21.4
Vulnerability : Information Disclosure
Severity: Medium
date: 2024
Prediction: 2024-04-24
What Undercode Say:
`curl -k “https://lxd-host:8443/1.0/images?project=non-existent-project”`
`curl -k “https://lxd-host:8443/1.0/images?project=real-project-name”`
How Exploit:
Project Enumeration via HTTP Code
Protection from this CVE
Patch LXD version
Block public API access
Impact:
Project existence leakage
Reconnaissance facilitation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
