PT-2018-12640 · Red Hat+1 · Red Hat Ceph Storage+1

Realasmo · Published 2018-10-09 · Updated 2023-02-13 · CVE-2018-14649

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage versions 2 and 3

Description The issue allows unauthenticated attackers to access a debug shell and escalate privileges. This is due to the ceph-isci-cli package using python-werkzeug in debug shell mode, enabled by setting debug=True in the /usr/bin/rbd-target-api file. Once connected to the debug shell, attackers can execute arbitrary commands remotely with the same privileges as the user running the application, which in the case of Red Hat Ceph Storage 2 and 3, is root level.

Recommendations For Red Hat Ceph Storage versions 2 and 3, consider disabling the debug shell mode in the python-werkzeug library as a temporary workaround until a patch is available. Restrict access to the /usr/bin/rbd-target-api file to minimize the risk of exploitation. Avoid using the ceph-isci-cli package with root level permissions until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2018-14649

RHSA-2018:2837

RHSA-2018:2838

Affected Products

Red Hat Ceph Storage

Python-Werkzeug

References · 9

• 🔥 https://github.com/ceph/ceph-iscsi-cli/issues/120 · Exploit
• https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2838 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 · Vendor Advisory
• https://access.redhat.com/articles/3623521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14649 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2837 · Vendor Advisory
• http://securityfocus.com/bid/105434 · Note