Improper Authentication in CoreOS etcd

1) Improper Authentication

EUVDB-ID: #VU64828

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-16886

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. A remote user can authenticate as user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

etcd: 3.2.0 - 3.3.10

CPE2.3

• cpe:2.3:a:coreos:etcd:3.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:coreos:etcd:3.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:coreos:etcd:3.2.2:*:*:*:*:*:*:*

External links

http://www.securityfocus.com/bid/106540
http://access.redhat.com/errata/RHSA-2019:0237
http://access.redhat.com/errata/RHSA-2019:1352
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886
http://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.2.md#security-authentication
http://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.3.md#security-authentication

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.