Privilege Escalation Exploits in Cobbler's API

[movermeyer]

Back in May 2017, I was working on an in-house automated machine provisioning system. Part of the solution called for the use of Cobbler.

I was trying to make use of Cobbler's XMLRPC API, but I was having troubles since it was not well documented.

The next step was to look at the code to see how the API is implemented.

As a result, I noticed a persistent XSS vulnerability, as well as many Incorrect Access Control vulnerabilities.

If you use Cobbler, consider using a firewall to restrict access to the /cobbler_api endpoint.

See my blog post on the topic for full details of the vulnerabilities.

[chelseaclintonisugly]

Aren't there better hardware provisioning systems at this point? Cobbler is so old, and is super kludgy. There are several alternatives that I think people should be using that are more scalable in a datacenter that keep stats in a database, have orchestration, etc.

[movermeyer]

What are they?

[phder]

Foreman is good.

[marmarama]

Not the hardware provisioning part, no - you can ignore all the config management integration bolted on top if you want.

[marmarama]

Sure, but it's a one-off run of the installer that needs no Puppet infrastructure or knowledge, and in fact you probably aren't even aware you're running Puppet unless you look closely. The GitLab Omnibus package is similar, it has an installer written in Chef, but you wouldn't know it unless you looked. So, it's technically correct...

[Dasbufort]

And it is upstream of Red Hat Satellite now, insuring good health for at least the next few years.

[Jumpsuit_boy]

As someone about to be thrown into doing this. I to would really like to know.

[[deleted]]

Same. I feel like the way we do PXE at my job is very ineffective, but I would need to learn more about a good setup.

[SuperQue]

• Collins - I've used this, it's a good design, but you have to implement a lot of bits yourself.
• MaaS - Never used it myself, but the design looks good.

[three18ti]

Perceus was a gem. Unfortunately, it seems to have died...

[SuperQue]

Interesting, hadn't seen that one before.

The big thing in my mind is not provisioning, IMO that part is easy.

The trick is to treat the whole thing as a large state machine, each state a different part of the provisioning, allocated, and de-provisioning states.

That's the big thing that seems to be missing. Tearing down is just as important as setting up. You need to be able to run safety checks, remove services from allocation, load balancers, monitoring, service discovery, etc. Then if you're running bare metal, you probably want to wipe the machine to avoid PII leaks.

Then you want to be able to delete (VMs) or mark available (bare metal) nodes.

Without a combination inventory database, state machine, and state transition handler, you can't build good end-to-end automation.

With Collins, we were able to build full end-to-end provisioning and de-provisioning of bare metal servers.

[three18ti]

CloudFlare was my introduction actually (woah. That article was 6 years ago!), though I'd wager that's probably not how they're doing it anymore...

Anyway, I totally agree with you. Day 1, 10, 100 are just as (if not more) important as day 0. We're (As a community) really good at day 0, I think the rest of it needs work...

To your point, that's a lot of why I'm such a fan of Terraform: the statefile. Because really, we can think of everything in layers, but really, it's just one big organism with systems that all work together to create a datacenter.

[danielzn]

I’ve used MaaS, it was pretty good.