PT-2018-10222 · Coreos+3 · Etcd+3

Zelivans · Published 2018-04-03 · Updated 2023-02-13 · CVE-2018-1098

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions etcd versions 3.3.1 and earlier

Description A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it is theoretically safe, but POST allows creating in-order keys that an attacker can send.

Recommendations For etcd versions 3.3.1 and earlier, consider disabling the POST request functionality to the etcd server as a temporary workaround until a patch is available. Restrict access to the etcd server to minimize the risk of exploitation. Avoid using the POST method in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2020-1882

ALT-PU-2020-2176

CVE-2018-1098

GHSA-5GJM-FJ42-X983

Affected Products

Alt Linux

Astra Linux

Debian

Etcd

References · 28

• 🔥 https://github.com/coreos/etcd/issues/9353 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1098 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5gjm-fj42-x983 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02944 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1099 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1098 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-2176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1098 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1098 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1098 · Vendor Advisory