Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability identified in Incus, a system container and virtual machine manager, impacting versions prior to 7.1.0. The issue resides in the S3 protocol upload endpoint, where a path traversal flaw could allow unauthorized creation of arbitrary files on the host system, potentially leading to command execution. The main concern is confirming relevance and exposure, as the vulnerability resides in a component that manages system containers and virtual machines.
- Path traversal flaw in file uploads.
- Critical vulnerability could lead to command execution.
- Confirm relevance and assess exposure to Incus.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending specially crafted requests to the S3 protocol upload endpoint of Incus. This endpoint, if exposed to the network, allows users with limited privileges to upload files. By manipulating the file path within these upload requests, an attacker can cause Incus to create arbitrary files on the host system. If these created files can be controlled by the attacker and subsequently executed, it could lead to the execution of commands on the host.
- Requires limited privileges and network access.
- Path traversal in S3 upload endpoint.
- Arbitrary file creation and command execution.
Live Threat
Current exploitation, exposure, and threat context
The S3 protocol upload endpoint in Incus, when running a version prior to 7.1.0, is susceptible to path traversal. This flaw could enable an authenticated attacker to create arbitrary files on the host system, potentially leading to the execution of commands with the privileges of the Incus service.
- Arbitrary file creation on the host.
- Remote authenticated upload through S3 endpoint.
- Host command execution possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Incus system container and virtual machine manager has a critical vulnerability in its S3 upload endpoint that could allow arbitrary file creation on the host and command execution. Teams responsible for managing infrastructure, virtualization, or container platforms should prioritize identifying all Incus deployments, assessing their exposure and business criticality, and confirming the accountable owner for remediation. Planning should then focus on risk-based actions, which may include coordinating with vendors, planning maintenance windows, or implementing temporary risk reduction measures.
- Infrastructure and Platform Teams own the issue.
- Verify Incus deployment and S3 endpoint reachability.
- Plan remediation based on asset criticality and risk.
