CVE-2020-13867
Description
An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highest threat from this vulnerability is to confidentiality.
Statement
The version of targetcli shipped with Red Hat Ceph Storage 3 sets the world-readable permissions for /etc/target and /etc/target/backup directory that store the sensitive information, hence affected by this vulnerability.
Mitigation
$ chmod -R og-rwx /etc/target
Future backup files will still be created with incorrect permissions, but attackers will not be able to access the target directory.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
Proposed changes to current CVSSv3 scoring:
AV:N -> AV:L PR:N -> PR:L I:H -> I:N A:H -> A:N
Integrity and Availability being high means that the attacker can write and crash/deny access to resources, which is difficult to do with the given information:
- To exploit this vulnerability an attacker need to access the target system locally (e.g., keyboard, console), or remotely (e.g., SSH). Hence, proposing a change to Attack Vector (AV) from Network (N) to Local (L).
- Here, attacker would be an authenticated local user, since user level access required to gain local access. Hence, Privileges required (PR) is set to Low.
- Write permissions are not assigned to
groupandotherusers for/etc/targetand backup directory(/etc/target/backup) , hence an attacker(non-root) user will not be able to modify any files or create new ones. Proposing a change to Integrity (I) from High (H) to None (N). - We do not see a situation were an attacker could cause an availability issue / DoS. Provided no write permissions are available, no custom scripts can be written/copied to the vulnerable path which can be later executed. Proposing a change to Availability (A) from High (H) to None (N).
The highest threat from this vulnerability is information disclosure which can result in total loss of confidentiality, as read permission is available for other users as well. For both (I) and (A), attacker do not have arbitrary control over modification of data or denial of availability. We consider this as a Moderate impact flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
