REDHAT-BUG-2569357: Medium severity Cockpit Cockpit vulnerability
A flaw was found in cockpit. The cockpit-storaged module's gettangadv() function (pkg/storaged/crypto/tang.jsx) builds curl's argument vector by string concatenation: cockpit.spawn(["curl", "-sSf", url + "/adv"]), with no "--" separator between options and the positional argument. On the Edit-Tang-keyserver path, this url value is read verbatim from a clevis token embedded in the LUKS header of a block device, which is data controlled by whoever can write to or attach that device, not necessarily the Cockpit operator. validateurl() only rejects empty strings and values that fail JavaScript URL parsing; a value such as "-K/var/tmp/stash" parses successfully (hostname "-k") and is accepted. When such a value reaches curl, curl interprets it as the "-K" (config file) option instead of a hostname, loading an attacker-planted curl configuration file. The planted configuration can set "output" to any path the Cockpit session user can write, "url" to a file:// URL to read any file that user can read, or "upload-file" with a remote destination to exfiltrate data -- all running as the Cockpit session user (not root; the LUKS-header read itself runs with superuser privileges via python.spawn(..., {superuser: "require"}), but the subsequent curl invocation does not). A local unprivileged user with a local, active console or desktop login session (not a remote SSH or Cockpit web session) can plant the malicious LUKS header using the standard, default-granted udisks2 org.freedesktop.udisks2.loop-setup polkit permission (allowactive=yes), requiring no elevated privilege. An administrator with Cockpit access who then opens the "Edit Tang keyserver" dialog for that device and clicks Save, without recognizing the prefilled value as a curl option rather than an address, triggers the chain. No non-default configuration is required.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when a Cockpit user uses the Edit-Tang-keyserver path on a block device whose LUKS header contains a clevis token controlled by someone who can write to or attach that device. The device-data attacker does not need to be the Cockpit operator.
What level of access does successful exploitation provide?
The resulting curl actions run as the Cockpit session user, not as root. An attacker-controlled curl configuration can read files that user can read, write to paths that user can write, or upload files to a remote destination.
What additional attacker-controlled content is needed for the curl option injection?
The malicious LUKS clevis token can supply a URL such as "-K/var/tmp/stash", which is accepted by the URL validation and treated by curl as a configuration-file option. Exploitation relies on an attacker-planted curl configuration file at the referenced path.