CVE-2021-29954
📋 TL;DR
This vulnerability in Hubs Cloud's Reticulum software allowed attackers to use the proxy functionality to access internal URLs, including sensitive metadata services. It affects all Hubs Cloud deployments running vulnerable versions, potentially exposing cloud credentials and internal infrastructure.
💻 Affected Systems
- Hubs Cloud
- Reticulum
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access cloud metadata services to obtain IAM credentials, leading to complete cloud environment compromise, data exfiltration, and lateral movement.
Likely Case
Unauthorized access to internal services, potential credential theft from metadata services, and exposure of internal network information.
If Mitigated
Limited to internal service enumeration if proper network segmentation and metadata service protections are in place.
🎯 Exploit Status
Simple HTTP requests to the proxy endpoint could exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: mozillareality/reticulum/1.0.1/20210428201255 or later
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-21/
Restart Required: Yes
Instructions:
1. Update Hubs Cloud deployment to use Reticulum version mozillareality/reticulum/1.0.1/20210428201255 or later. 2. Restart all Reticulum services. 3. Verify the update was successful.
🔧 Temporary Workarounds
Block proxy endpoint
allTemporarily block access to the vulnerable proxy functionality using web application firewall or network controls.
Restrict metadata service access
allImplement network policies to restrict access to cloud metadata services from application instances.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Hubs Cloud from metadata services
- Deploy web application firewall with rules to block proxy requests to internal URLs
🔍 How to Verify
Check if Vulnerable:
Check Reticulum version in deployment configuration or by querying the service endpoint.Check Version:
Check deployment configuration or service logs for Reticulum version information.Verify Fix Applied:
Confirm Reticulum version is mozillareality/reticulum/1.0.1/20210428201255 or later and test that proxy requests to internal URLs are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to proxy endpoint with internal URLs
- Access attempts to metadata service from application instances
Network Indicators:
- Outbound connections from Hubs Cloud to metadata service endpoints
- Unusual proxy request patterns
SIEM Query:
source="hubs-cloud" AND (url="*/proxy*" OR destination_ip="169.254.169.254")