Listen to this Post
The vulnerability exists in the LXD image export API endpoint (/1.0/images/{fingerprint}/export). This endpoint uses a SQL `LIKE` clause for fingerprint matching, allowing wildcards like %. When an unauthenticated request with a wildcard (e.g., %) matches multiple images within an existing project, the database query returns multiple results, triggering a “More than one image matches” error, which is returned as an HTTP 500 status code. However, if the specified project does not exist, the same query finds zero images and the API returns an HTTP 404 “not found” error. This discrepancy in error codes (500 vs 404) based solely on project existence allows an attacker to enumerate valid project names without any authentication.
Platform: LXD
Version: <6.5, <5.21.4
Vulnerability: Project Enumeration
Severity: Medium
date: 2024-04-23
Prediction: 2024-05-07
What Undercode Say:
curl -k 'https://lxd-host:8443/1.0/images/%25/export?project=default' curl -k 'https://lxd-host:8443/1.0/images/%25/export?project=not-exist'
// lxd/db/images.go
_, err := db.LookupImage(ctx, tx, project, fmt.Sprintf("%s%%", fingerprint))
if response.IsNotFoundError(err) {
return "", err
}
if err != nil {
return "", fmt.Errorf("More than one image matches")
}
How Exploit:
Project existence brute-forcing.
Protection from this CVE
Patch LXD versions.
Uniform 404 errors.
Impact:
Project name leakage.
Reconnaissance for attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
