Skip to content
Fencer Vulns
medium 4.7

CVE-2024-31463 json

Ironic-image allows unauthenticated local access to Ironic API

published 2024-04-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-29345

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` variable set to `true`, 1) HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2) Ironic listens in host network on a private port 6388 on localhost by default. As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication. A similar problem affects Ironic Inspector (`INSPECTOR_REVERSE_PROXY_SETUP` set to `true`), although the attack potential is smaller there. This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the `IRONIC_PRIVATE_PORT` variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings. This vulnerability is fixed in 24.1.1.

Patch / fix

  • metal3 ironic-image 24.1.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-31463 updated cvss 4.7

ironic-image: Unauthenticated local access to Ironic API

  • Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-ironic-rhel9 v4.12.0-202404301511.p0.g9a3e609.assembly.stream.el9
    fixed: vendor fix RHSA-2024:2782
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-ironic-rhel9 v4.13.0-202405072309.p0.g881e793.assembly.stream.el9
    fixed: vendor fix RHSA-2024:2875
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ironic-rhel9 v4.14.0-202404250639.p0.g0e91ffa.assembly.stream.el9
    fixed: vendor fix RHSA-2024:2668
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9 v4.15.0-202404240736.p0.gc5321a9.assembly.stream.el9
    fixed: vendor fix RHSA-2024:2068
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202405092134-0, openshift4/ose-cli v4.12.0-202405091536.p0.gd691257.assembly.stream.el8, openshift4/ose-pod v4.12.0-202405091536.p0.g054f0ba.assembly.stream.el8, openshift4/ose-etcd v4.12.0-202405091536.p0.gbb82e89.assembly.stream.el8, openshift4/ose-tests v4.12.0-202405091536.p0.g7b7d4ef.assembly.stream.el8, openshift4/ose-console v4.12.0-202405091536.p0.g5d4bea1.assembly.stream.el8, +185 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202405132113-0, openshift4/ose-cli v4.13.0-202405141537.p0.gd192e90.assembly.stream.el8, openshift4/ose-pod v4.13.0-202405141537.p0.g4818370.assembly.stream.el8, openshift4/ose-tests v4.13.0-202405141537.p0.g99b9d53.assembly.stream.el8, openshift4/ose-console v4.13.0-202405141537.p0.ga1d0be0.assembly.stream.el8, openshift4/ose-coredns v4.13.0-202405141537.p0.g298d919.assembly.stream.el8, +186 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202404301839-0, openshift4/ose-cli v4.14.0-202404250639.p0.gf7b14a9.assembly.stream.el8, openshift4/ose-pod v4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8, openshift4/ose-tests v4.14.0-202404250639.p0.g2989703.assembly.stream.el8, openshift4/ose-console v4.14.0-202404281941.p0.g646ce7a.assembly.stream.el8, openshift4/ose-coredns v4.14.0-202404250639.p0.g7d3fa77.assembly.stream.el8, +187 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202404251009-0, openshift4/ose-cli v4.15.0-202404242206.p0.g62c4d45.assembly.stream.el8, openshift4/ose-tests v4.15.0-202404242206.p0.g8fe25d7.assembly.stream.el8, openshift4/ose-console v4.15.0-202404250638.p0.g581297f.assembly.stream.el8, openshift4/ose-deployer v4.15.0-202404242206.p0.g62c4d45.assembly.stream.el8, openshift4/ose-installer v4.15.0-202404250638.p0.g626dfd5.assembly.stream.el8, +90 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

  • metal3-io ironic-image

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.