CVE-2023-40585
📋 TL;DR
This vulnerability exposes the Ironic API without authentication when TLS is disabled and API/Conductor services aren't separated. It affects Metal³ deployments where operators have explicitly configured Ironic without TLS protection. Attackers could access the API without credentials, potentially compromising bare metal management functions.
💻 Affected Systems
- metal3-io/ironic-image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers could gain full administrative control over bare metal infrastructure, provision unauthorized systems, modify hardware configurations, or exfiltrate sensitive hardware data.
Likely Case
Unauthorized access to Ironic API allowing information disclosure about hardware inventory, configuration details, and potential manipulation of provisioning states.
If Mitigated
With TLS enabled or proper authentication configured, the API remains protected and inaccessible to unauthorized users.
🎯 Exploit Status
Exploitation requires network access to the Ironic API endpoint and knowledge that TLS is disabled. No special tools needed beyond HTTP client.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: capm3-v1.4.3 and newer
Vendor Advisory: https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7
Restart Required: Yes
Instructions:
1. Update to ironic-image version capm3-v1.4.3 or later. 2. Redeploy Ironic services. 3. Verify TLS and authentication are properly configured.
🔧 Temporary Workarounds
Enable TLS for Ironic API
linuxConfigure Ironic with TLS encryption which enables proper authentication
deploy.sh -t ...
export IRONIC_TLS_SETUP=true && ./deploy.sh
Split API and Conductor services
linuxSeparate Ironic API and Conductor services (legacy approach, not recommended)
Modify configuration to deploy API and Conductor as separate services
🧯 If You Can't Patch
- Enable TLS immediately using deploy.sh -t or IRONIC_TLS_SETUP=true
- Implement strict network controls: firewall rules to restrict access to Ironic API, network segmentation, and zero-trust principles
🔍 How to Verify
Check if Vulnerable:
Check if Ironic API is accessible without authentication via HTTP (not HTTPS) and verify TLS is disabled in configuration.Check Version:
kubectl get pods -n metal3 -l app=ironic -o jsonpath='{.items[*].spec.containers[*].image}' | grep -o 'capm3-v[0-9.]*'Verify Fix Applied:
1. Confirm version is capm3-v1.4.3+. 2. Verify Ironic API requires authentication. 3. Test that HTTP access is blocked or redirected to HTTPS.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated API access attempts
- HTTP requests to Ironic API without TLS
- Authentication failure logs when TLS is disabled
Network Indicators:
- Unencrypted HTTP traffic to Ironic API port
- Network scans targeting Ironic default ports
SIEM Query:
source="ironic" AND (http_request AND NOT tls) OR (auth_failure AND api_access)🔗 References
- https://github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311de9
- https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7
- https://github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311de9
- https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7
