Information Exposure in Canonical MAAS

Executive Summary

This vulnerability is an information exposure flaw in Canonical MAAS versions prior to 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0. An unauthenticated attacker can retrieve the RPC secret in plaintext via the vendor data metadata endpoint if a machine was deployed with the 'register as rack' option enabled. The attacker needs the machine's system ID to exploit this.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any machines in your MAAS deployment were configured with the 'install_rackd' parameter set to true. Inspect MAAS logs for attempts to deploy machines as rack controllers. Verify if the vendor data metadata endpoint is accessible and if RPC secrets are exposed in plaintext.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker can obtain the RPC secret, register additional rack controllers, leak BMC secrets, and perform further malicious activities within the MAAS environment. This could lead to unauthorized access and control over deployed machines.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive RPC secrets if machines were deployed with the 'register as rack' option. Unauthorized access to these secrets may lead to unauthorized rack controller registration, BMC secret leaks, and further malicious activities, violating data protection and security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade MAAS to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, or 3.8.0 or later to disable the vulnerable 'install_rackd' feature. Ensure no machines are deployed with the 'register as rack' option enabled. Review and revoke any exposed RPC secrets.

Useful 0 Not Useful 0