{"id":"CVE-2024-31463","summary":"Ironic-image allows unauthenticated local access to Ironic API","details":"Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` variable set to `true`, 1) HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2) Ironic listens in host network on a private port 6388 on localhost by default. As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication. A similar problem affects Ironic Inspector (`INSPECTOR_REVERSE_PROXY_SETUP` set to `true`), although the attack potential is smaller there. This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the `IRONIC_PRIVATE_PORT` variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings. This vulnerability is fixed in 24.1.1. ","aliases":["GHSA-g2cm-9v5f-qg7r"],"modified":"2026-08-12T03:51:21.432770589Z","published":"2024-04-17T15:21:49.384Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31463.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-288"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31463.json"},{"type":"ADVISORY","url":"https://github.com/metal3-io/ironic-image/security/advisories/GHSA-g2cm-9v5f-qg7r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31463"},{"type":"FIX","url":"https://github.com/metal3-io/ironic-image/commit/48e40bd30d49aefabac6fc80204a8650b13d10b4"},{"type":"FIX","url":"https://github.com/metal3-io/ironic-image/pull/494"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metal3-io/ironic-image","events":[{"introduced":"0"},{"fixed":"48e40bd30d49aefabac6fc80204a8650b13d10b4"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"24.1.1"}]}}],"versions":["v24.1.0","capm3-v1.7.0.beta.0","capm3-v1.5.2","capm3-v1.5.1","capm3-v1.5.0","capm3-v1.4.6","capm3-v1.4.5","capm3-v1.4.4","capm3-v1.4.3","capm3-v1.4.2","capm3-v1.4.1","capm3-v1.4.0","capm3-v1.3.5","capm3-v1.3.4","capm3-v1.3.3","capm3-v1.3.2","capm3-v1.3.1","capm3-v1.3.0","capm3-v1.2.2","capm3-v1.2.1","capm3-v1.2.0","capm3-v1.1.4","capm3-v1.1.3","capm3-v1.1.2","capm3-v1.1.1","capm3-v1.1.0","capm3-v0.5.5","capm3-v0.5.4","capm3-v0.5.3","capm3-v0.5.2","capm3-v0.5.1","capm3-v0.5.0","capm3-v0.4.3","capm3-v0.4.1","capm3-v0.4.0","capm3-v0.3.2","capm3-v0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31463.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}