CVE-2024-31463
CVSS 3.1 Score 4.7 of 10 (medium)
Details
Summary
CVE-2024-31463 is a vulnerability affecting OpenStack Ironic, specifically when the reverse proxy mode is enabled. In this setup, HTTP basic credentials are validated externally to the Ironic service, and Ironic listens on a private port (6388 by default) on localhost. Consequently, any Pod or local Unix user with sufficient privileges on the control plane node can access the Ironic API on the private port without authentication. This issue, which impacts both the Ironic service and Inspector, could allow an attacker to modify bare-metal machines by provisioning new images or changing BIOS settings. This vulnerability, which is resolved in version 24.1.1, poses a significant risk to operators deploying Ironic in reverse proxy mode and not setting the `IRONIC_PRIVATE_PORT` variable or using a non-numeric value.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions