Listen to this Post
The vulnerability exists in LXD’s operations API endpoint (/1.0/operations). When queried, this API returns metadata for all running operations, which includes the `fds` field containing the secret tokens required for authenticating WebSocket connections to active terminal and console sessions. These secrets are meant to be accessible only to the user who initiated the session. However, the API erroneously exposes these secrets to any user with read-level permissions to the project. An attacker with a read-only account can continuously poll the `/1.0/events` API to detect when a new terminal operation is started by a privileged user. The event data includes the operation ID and the associated secrets. The attacker can then immediately use these secrets to establish their own WebSocket connection to the victim’s session. Since the WebSocket handshake uses a “first-come, first-served” mechanism for authentication with the secret, the attacker can hijack the session, gaining the ability to execute arbitrary commands with the victim’s privileges inside the container or virtual machine instance.
Platform: LXD
Version: <6.5, <5.21.4
Vulnerability: Session Hijacking
Severity: Critical
date: 2024
Prediction: 2024-05-23
What Undercode Say:
curl -s -k --cert ~/.config/lxc/client.crt --key ~/.config/lxc/client.key "https://$(lxc remote get-default)/1.0/operations" | jq '.metadata[] | .id, .metadata.fds'
const ws = new WebSocket(<code>wss://lxd-host/1.0/operations/${opId}/websocket?secret=${secret}</code>);
ws.onopen = () => { ws.send('id\n'); };
How Exploit:
1. Attacker with read-permissions monitors `/1.0/events`.
2. Victim starts a terminal session.
3. Attacker’s script extracts secrets from the event.
4. Script initiates a rogue WebSocket connection.
5. Attacker gains control of the victim’s shell.
Protection from this CVE
Upgrade to LXD 6.5 or LXD 5.21.4. Implement strict user permission checks. Apply the principle of least privilege. Filter the `fds` field from API responses for non-admin users.
Impact:
Privilege Escalation. Arbitrary Command Execution. Container/VM Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
