OpenStack Ironic Unintended File Write Vulnerability in Image Handling

A vulnerability in OpenStack Ironic versions prior to 29.0.1 allows for unintended file writes to a target node's disk during image processing, specifically when deployments are managed through the API. This issue arises because a malicious project, designated as the node owner, can specify a path to any local file accessible by ironic-conductor. While this vulnerability is challenging to exploit under normal circumstances—since a node should not enter the ACTIVE state if deployed in this way—it poses a risk in environments with non-default, insecure settings, such as those with automated cleaning turned off.

Impact

Exploitation of this vulnerability could lead to unauthorized file writes on a target node's disk, potentially allowing for the manipulation of files or data on that node.

Remediation

Users can upgrade to OpenStack Ironic versions 24.1.3, 26.1.1, or 29.0.1 to address this vulnerability.