Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability in the Eclipse ioFog Controller could allow unauthorized access to microservices and edge nodes. This issue stems from improper verification of security tokens used for remote command execution and log access, potentially enabling attackers to gain control over these systems. The primary concern is to confirm if our environment utilizes this specific technology and assess any exposure.
- Unverified security tokens allow unauthorized access.
- Critical controller could be compromised.
- Confirm relevance and exposure to affected systems.
Attack Path
How an attacker could exploit the issue
Attackers can compromise the Eclipse ioFog Controller by exploiting how it handles WebSocket connections for executing commands and retrieving logs. By crafting a specific token, an attacker can impersonate an administrator to gain unauthorized control over microservices or edge devices. This bypasses normal security checks that are in place for regular HTTP traffic.
- No authentication required to initiate.
- WebSocket upgrade with crafted token.
- Full administrative control over devices.
Live Threat
Current exploitation, exposure, and threat context
An attacker could gain unauthorized access to control WebSocket sessions for microservices or fog nodes they are aware of. This occurs because the operator WebSocket upgrades for exec and log routes do not properly validate the bearer JWT, allowing a self-minted token with admin group privileges to bypass role-based access controls. This bypass is possible when supported by the advisory.
- System control of microservices or fog nodes.
- Unverified JWTs allow unauthorized session access.
- Unauthorized control over deployed services.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Eclipse ioFog Controller's WebSocket endpoint for operator commands is vulnerable, allowing unauthenticated attackers to execute arbitrary commands on managed microservices or fog nodes if they know the target's UUID. This impacts the control plane and requires immediate attention from teams managing the ioFog deployment. The first step is to identify all ioFog controller instances, determine their network exposure, confirm business criticality, and locate the accountable owner to plan remediation.
- Confirm ioFog controller ownership and scope.
- Verify network exposure and critical assets.
- Plan for remediation based on risk assessment.
