PT-2021-19960 · Zstack · Z-Stack
Alvaro Muñoz
+1
·
Published
2021-08-17
·
Updated
2022-10-25
·
CVE-2021-32829
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ZStack versions prior to 3.8.21
ZStack versions prior to 3.10.8
ZStack versions prior to 4.1.0
Description
ZStack is open source IaaS software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution (RCE) via bypass of the Groovy shell sandbox. The REST API exposes the "zstack/v1/batch-queries?script" endpoint which is backed up by the BatchQueryAction class. Messages are represented by the
APIBatchQueryMsg, dispatched to the QueryFacadeImpl facade and handled by the BatchQuery class. The HTTP request parameter script is mapped to the APIBatchQueryMsg.script property and evaluated as a Groovy script in BatchQuery.query. The evaluation of the user-controlled Groovy script is sandboxed by SandboxTransformer which will apply the restrictions defined in the registered GroovyInterceptor. Even though the sandbox heavily restricts the receiver types to a small set of allowed types, the sandbox is non-effective at controlling any code placed in Java annotations and therefore vulnerable to meta-programming escapes. This issue leads to post-authenticated remote code execution.Recommendations
For versions prior to 3.8.21, update to version 3.8.21 or later.
For versions prior to 3.10.8, update to version 3.10.8 or later.
For versions prior to 4.1.0, update to version 4.1.0 or later.
As a temporary workaround, consider restricting access to the "zstack/v1/batch-queries?script" endpoint until a patch is available.
Exploit
Fix
Incorrect Authorization
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Z-Stack