Vulnerability GHSA-x585-4vv8-2mh2

Critical

15 hours ago

Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

1.14.0.post1 and 1.14.0.post2 and 1.14.1.post1 and 1.14.2 and 1.14.6 - 1.14.8 and 1.14.8.post1 and 1.14.8.post2 and 1.14.9 and 1.14.9.post1 and 1.15.0 and 1.15.0.post1 and 1.15.2 - 1.15.3 and 1.15.3.post1 and 1.15.4 and 1.15.4.post1 and 1.16.0 and 1.16.0.post1 and 1.16.1 - 1.17.2 and 1.17.2.post1 and 1.17.5 - 1.17.6 and 1.17.6.post1 and 1.17.6.post2 and 1.17.7 - 1.17.8 and 1.17.8.post1 and 1.17.8.post2 and 1.18.0 - 1.18.1 and 1.18.3 - 1.18.5 and 1.18.5.post1 and 1.18.6 and 1.18.6.post1 and 1.18.7 - 1.18.8 and 1.18.8.post1 and 1.18.9 and 1.19.0.post2 and 1.19.1 and 1.19.3 - 1.19.4 and 1.19.4.post1 and 1.19.4.post2 and 1.19.5 - 1.19.7 and 1.19.7.post1 and 1.19.8 - 1.20.0rc1 and 1.20.0 - 1.20.1 and 1.20.1.post1 and 1.20.2 - 1.20.3rc1 and 1.20.3rc2 and 1.20.3 - 1.20.4rc1 and 1.20.4rc2 and 1.20.4rc3 and 1.20.4 and 1.20.4.post1 and 1.20.4.post2 and 1.20.5 - 1.20.16 and 1.21.0.dev1 and 1.21.0rc1 and 1.21.0rc2 and 1.21.0rc3 and 1.21.0 and 1.21.0.post1 and 1.21.0.post2 and 1.21.1 - 1.21.8 and 1.21.10 and 1.21.10.post1 and 1.21.12 and 1.22.0.dev1 and 1.22.0.dev2 and 1.22.0.dev3 and 1.22.0rc1 and 1.22.0rc2 and 1.22.0 - 1.22.3 and 1.22.3.post1 and 1.22.4.dev1 and 1.22.4 and 1.22.6 and 1.22.6.post1 and 1.22.7 - 1.22.8 and 1.22.8.post1 and 1.23.0rc1 and 1.23.0rc2 and 1.23.0 - 1.23.2 and 1.23.2.post1 and 1.23.2.post2 and 1.23.4 - 1.23.5 and 1.23.5.post1 and 1.23.6 and 1.23.6.post1 and 1.23.7 and 1.23.7.post1 and 1.23.8 - 1.23.9 and 1.23.9.post1 and 1.23.9.post2 and 1.23.9.post3 and 1.23.9.post4 and 1.23.10 - 1.23.11 and 1.23.11.post1 and 1.23.11.post2 and 1.23.11.post3 and 1.23.11.post4 and 1.23.12 - 1.23.15 and 1.23.17 - 1.24.0rc1 and 1.24.0 - 1.24.1 and 1.24.1.post1 and 1.24.1.post2 and 1.24.1.post3 and 1.24.1.post4 and 1.24.2 and 1.24.2.post1 and 1.24.3 and 1.24.3.post1 and 1.24.4 - 1.24.5 and 1.24.5.post1 and 1.25.0rc1 and 1.25.0rc2 and 1.25.0 - 1.25.1 and 1.25.1.post1 and 1.25.2 - 1.25.3 and 1.25.3.post1 and 1.25.3.post2 and 1.25.4 and 1.25.4.post1 and 1.25.5 - 1.26.0rc1 and 1.26.0rc2 and 1.26.0 - 1.26.1 and 1.26.1.post1 and 1.26.2 and 1.26.4 - 1.26.7 and 1.26.7.post1 and 1.26.8 and 1.26.8.post1 and 1.26.9 - 1.27.0rc1 and 1.27.0rc2 and 1.27.0 and 1.27.0.post1 and 1.27.1 - 1.27.4 and 1.27.4.post1 and 1.27.5 and 1.27.7 and 1.27.9 - 1.28.0rc1 and 1.28.0rc2 and 1.28.0 - 1.29.0rc1 and 1.29.0rc2 and 1.29.0 - 1.29.2 and 1.29.2.post1 and 1.29.2.post2 and 1.29.3 and 1.29.3.post1 and 1.29.4 - 1.29.7 and 1.29.7.post1 and 1.29.8 - 1.30.0rc1 and 1.30.0rc2 and 1.30.0rc3 and 1.30.0 - 1.31.0rc1 and 1.31.0rc2 and 1.31.0rc3 and 1.31.0 - 1.31.7 and 32.0.0rc1 and 32.0.0rc2 and 32.0.0 - 32.5.0 and 32.5.0.post1 and 32.5.1 - 32.6.0 and 32.6.0.post1 and 32.7.0 - 33.0.0rc1 and 33.0.0rc2 and 33.0.0rc3 and 33.0.0 - 33.4.0 and 33.4.0.post1 and 33.5.0 - 34.0.0rc1 and 34.0.0rc2 and 34.0.0 - 35.0.0rc1 and 35.0.0rc2 and 35.0.0 - 36.0.0rc1 and 36.0.0rc2 and 36.0.0rc3 and 36.0.0rc4 and 36.0.0rc5 and 36.0.0 and 36.0.0.post1 and 36.0.0.post2 and 36.1.0 - 37.0.0rc1 and 37.0.0rc2 and 37.0.0rc3 and 37.0.0rc4 and 37.0.0 - 37.1.0 and 37.1.0.post1 and 37.2.0 - 38.0.0rc1 and 38.0.0rc2 and 38.0.0rc3 and 38.0.0 - 39.0.0rc1 and 39.0.0rc2 and 39.0.0 - 40.0.0rc1 and 40.0.0 - 41.0.0rc1 and 41.0.0 - 41.1.0

Summary

Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

Details

Summary

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.

While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints.

Proof of Concept

The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and validate_auth_token in lib/rucio/core/authentication.py accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token:

Request a challenge token for an arbitrary account (e.g., "root"): curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token
The server returns a 200 OK with the header X-Rucio-SSH-Challenge-Token.
The attacker can then use this specific token within the ten-second challenge lifetime as an authentication credential in subsequent requests to the Rucio API: curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN" https://rucio/accounts/whoami