Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3.

When the reverse proxy mode is enabled by the IRONIC_REVERSE_PROXY_SETUP variable set to true:

1. HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself.
2. Ironic listens in host network on a private port 6388 on localhost by default.

As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication.

A similar problem affects Ironic Inspector (INSPECTOR_REVERSE_PROXY_SETUP set to true), although the attack potential is smaller there.

Impact

This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the IRONIC_PRIVATE_PORT variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings.

Patches

• Use unix sockets by default for reverse proxy communication

Workarounds

Two different workarounds are possible:

1. Switch to using unix sockets for traffic between HTTPD and Ironic/Inspector (recommended). Set the variables IRONIC_PRIVATE_PORT and IRONIC_INSPECTOR_PRIVATE_PORT to the value unix.
2. Temporarily stop using the reverse proxy mode (set IRONIC_REVERSE_PROXY_SETUP and INSPECTOR_REVERSE_PROXY_SETUP to false).

Using the workaround may require Baremetal Operator reconfiguration, depending on the deployed Metal3 configuration. See referenced pull requests.

References

• Ironic-image probe script addition
• Baremetal Operator probe usage change, part of BMO v0.6.0 and newer.