Etcd: Mitigate CSRF and DNS Rebinding attacks

Created on 25 Feb 2018 · 6Comments · Source: etcd-io/etcd

After explaining the issue in private with the security mailing list, we determined it is low enough in severity to make it a public discussion.

This issue is relevant only to etcd deployment on local networks with no authentication scheme set up. It may not be a common scenario but it affects anyone who work with etcd locally or on a local network and use it without authentication, which is the default. For the sake of demonstration, I'm using a scenario where etcd is deployed on localhost. This can be any LAN address though (the attacker would have to know the address as a perquisite, but localhost is pretty common).

The first issue is with CSRF. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

Example PoC:

<html>
    <body onload="document.forms[0].submit()">
        <h1>CSRF</h1>
        <form action="http://localhost:2379/v2/keys/bla" method="POST">
            <input type="hidden" name="value" value="MALICIOUS"/>
            <input type="submit" value="Send"/>
        </form>
    </body>
</html>

The second issue is with DNS rebinding. It essentially means an attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

There are many resources on how this attack works.

PoC here (based on taviso's work). If the issue is unclear though please let me know and I will explain the attack in further details.

Success example:

Whitelisting hostnames is a possible simple solution. See taviso's comment on this or the fix he sent to Transmission.

arefeature aresecurity

Source

zelivans

Most helpful comment

Hi, does this affect stable release? and is there any plan to backport the security fix, especially 3.2.x?

zhsj on 13 Feb 2019

👍3

All 6 comments

We've added --host-whitelist flag. This will be released in 3.4.

Thanks for report!

gyuho on 1 Mar 2018

🎉1

any cve assigned to these issues ?

sidhax on 3 Apr 2018

@sidhax I've attempted to assign CVE IDs through DWF but CoreOS is acquired by Red Hat so it was
forwarded to them and I wasn't yet informed of anything from their side

zelivans on 3 Apr 2018

Two CVEs were assigned for this:

CVE-2018-1098 etcd: Cross-site request forgery via crafted local POST forms
CVE-2018-1099 etcd: DNS rebinding vulnerability in etcd server