MAAS Unauthenticated Remote RPC Command Execution Vulnerability

A vulnerability in MAAS (Metal as a Service) allows for unauthenticated remote execution of RPC commands on the region server. This issue arises from inadequate authentication verification, enabling a malicious client to bypass authentication checks and execute commands within a specific region. The vulnerability is present in all MAAS versions.

Impact

Exploitation of this vulnerability allows for unauthorized remote execution of commands on the MAAS region server, which could disrupt services or manipulate resources within the managed environment.

Reproduction

The vulnerability can be reproduced by establishing a TCP connection to the MAAS region server's RPC port (5251) using a Twisted AMP client. Once connected, the client can bypass authentication and send commands to the server, such as creating nodes or updating power states, which could lead to a denial-of-service condition or unauthorized manipulation of resources.

Remediation

This vulnerability has been fixed in MAAS versions 3.1.4 and 3.2.11. Users can upgrade to these versions to address the issue.