RCE in [Unknown] Ceph-Iscsi-Cli
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.120 (96.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.117 · newest: 0.120 · change: +0.002
Affected products
- [Unknown] Ceph-Iscsi-Cli
- Red Hat Ceph-Iscsi-Cli
- Red Hat Ceph Storage — versions 2.0, 3.0
- Red Hat Enterprise Linux Desktop — versions 7.0
- Red Hat Enterprise Linux Server — versions 7.0
- Red Hat Enterprise Linux Workstation — versions 7.0
Weakness classification (CWE)
References
- access.redhat.com/articles/3623521 (Patch, Mitigation, Vendor Advisory)
- www.securityfocus.com/bid/105434 (VDB Entry, Third Party Advisory, vdb-entry)
- github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d… (Patch, Vendor Advisory)
- github.com/ceph/ceph-iscsi-cli/issues/120 (Exploit, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2838 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2837 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-14649?
- CVE-2018-14649 is a critical-severity vulnerability in [Unknown] Ceph-Iscsi-Cli, classified under Command Injection. CVSS score: 9.8/10. Published 2018-10-09.
- How severe is CVE-2018-14649?
- Critical severity. CVSS v3 base score is 9.8 out of 10.