OS Command Injection in NooBaa Multi-Cloud Object Gateway

Executive Summary

This is an OS command injection vulnerability in NooBaa's cluster_internal_api, specifically in the set_hostname_internal function. The flaw occurs because the hostname parameter is passed directly to a shell command without sanitization. An authenticated attacker with admin privileges can inject shell metacharacters into the hostname to execute arbitrary commands on the host system with NooBaa process privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the noobaa-core project for the set_hostname function in src/util/os_utils.js. Check if the hostname parameter is directly interpolated into shell commands without sanitization. Look for unusual command execution patterns or unauthorized processes running as the noob user (UID 10001).

Commands to check: grep -r 'set_hostname' /path/to/noobaa-core, ps aux | grep noob, and audit logs for suspicious RPC method calls to cluster_internal_api.set_hostname_internal.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute arbitrary commands on the host system with the privileges of the NooBaa process. This may lead to full container compromise, unauthorized access to sensitive data, or disruption of services. The attack requires admin privileges but could result in significant system compromise if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized command execution on the host system, potentially compromising data confidentiality, integrity, and availability. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and requiring breach notifications. For HIPAA, it could expose protected health information to unauthorized parties, leading to compliance violations and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict administrative access to the NooBaa cluster_internal_api. Avoid using the set_hostname_internal function until a patch is available. Monitor container activity for unauthorized command execution.

If exploitation is suspected, isolate the affected container, revoke all administrative tokens, and review logs for signs of compromise. No official mitigation is currently available per Red Hat.

Useful 0 Not Useful 0