CVSS 10.0 LXD and MicroCloud Flaw Let Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud let attackers log in as a trusted client without that client's private key, provided they could reach the HTTPS API over the network and had the client's public certificate.
Key points
- A critical flaw (CVSS 10.0) affected Canonical’s LXD and MicroCloud.
- An attacker could log in as a trusted client without holding that client’s private key.
- Exploitation required network access to the HTTPS API and the trusted client’s public certificate.
Canonical’s LXD and MicroCloud contained a critical security flaw with a CVSS score of 10.0, the maximum rating. It let an attacker log in as a trusted client without holding that client’s private key.
Details
To exploit the flaw, the attacker needed two things: the ability to reach the HTTPS API of the LXD or MicroCloud deployment over the network, and the trusted client’s public certificate. Normally, holding the private key is what lets a client prove its identity. Here, the attacker did not need it.
After logging in, the attacker would act as that client, with access to the cluster and its virtual machines.
Why it matters
The flaw broke the assumption that only the holder of a client’s private key can act as that client. Any deployment whose HTTPS API is reachable over the network was potentially at risk, and a successful impersonation gave the attacker that client’s access to the cluster and its virtual machines.
What to do
- Restrict network access to the HTTPS API so only legitimate clients can reach it.
- Review which client certificates the cluster trusts.