Curl Option Injection in Cockpit-Storaged via Tang Keyserver

Executive Summary

This vulnerability exists in cockpit-storaged where a Tang keyserver address from a clevis token in a LUKS header is improperly concatenated into curl's argument vector without a '--' separator. If the address starts with '-', curl misinterprets it as an option rather than a hostname, allowing an attacker to inject curl options.

Useful 0 Not Useful 0

Detection Guidance

Check if cockpit-storaged is installed and its version using: rpm -q cockpit-storaged or dnf list installed cockpit-storaged. Inspect LUKS/clevis configurations for malformed Tang keyserver addresses starting with a hyphen. Review system logs for unusual curl command executions or file operations by Cockpit users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local unprivileged access can craft a malicious LUKS header to inject curl options. When an administratively-privileged Cockpit user edits and saves Tang keyserver settings, this could lead to arbitrary file read or write operations as the Cockpit session user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Exploitation may result in data breaches, non-compliance with data protection regulations, and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict local console or desktop login access to trusted users. Verify Tang keyserver addresses in the Cockpit 'Edit Tang keyserver' dialog before saving. Monitor for unauthorized file operations by Cockpit users. Apply vendor patches when available to fix the underlying code flaw.

Useful 0 Not Useful 0