CVE-2021-40494
📋 TL;DR
This vulnerability involves a hardcoded JWT secret key in AdaptiveScale LXDUI that allows attackers to forge authentication tokens and gain administrative access to the host system. Any system running vulnerable versions of LXDUI is affected, potentially giving attackers full control over the LXD container management platform.
💻 Affected Systems
- AdaptiveScale LXDUI
📦 What is this software?
Lxdui by Adaptivescale
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to the host system, allowing them to create, modify, or delete containers, access host filesystems, and potentially pivot to other systems on the network.
Likely Case
Unauthorized users gain administrative privileges to the LXDUI interface, enabling container manipulation, privilege escalation, and potential lateral movement within the environment.
If Mitigated
With proper network segmentation and access controls, impact is limited to the LXDUI service itself, though container compromise remains possible.
🎯 Exploit Status
Exploitation requires network access to LXDUI but no authentication. Attackers can forge JWT tokens using the hardcoded secret.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.4 and later
Vendor Advisory: https://github.com/AdaptiveScale/lxdui/pull/353
Restart Required: Yes
Instructions:
1. Update to LXDUI version 2.1.4 or later. 2. Restart the LXDUI service. 3. Regenerate all existing JWT tokens.
🔧 Temporary Workarounds
Manual Secret Replacement
linuxManually replace the hardcoded JWT secret with a strong, unique value
sed -i "s/\"SECRET_KEY\": \"[^\"]*\"/\"SECRET_KEY\": \"$(openssl rand -hex 32)\"/" /path/to/lxdui/metadata.py
systemctl restart lxdui
🧯 If You Can't Patch
- Isolate LXDUI behind strict network access controls and firewall rules
- Implement additional authentication layers such as VPN or reverse proxy with authentication
🔍 How to Verify
Check if Vulnerable:
Check metadata.py for hardcoded JWT secret: grep -r 'SECRET_KEY' /path/to/lxdui/Check Version:
lxdui --version or check package managerVerify Fix Applied:
Verify the secret has been changed and is no longer hardcoded to the vulnerable value📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed login attempts followed by successful admin access
- Unexpected container creation/modification
Network Indicators:
- Unusual API calls to LXDUI endpoints
- Traffic from unexpected sources to LXDUI port
SIEM Query:
source="lxdui" AND (event="admin_login" OR event="container_create") AND user="unknown"