https://feed.craftedsignal.io/products/incus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 28 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2024-01-incus-path-traversal/Sun, 28 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-incus-path-traversal/A path traversal vulnerability in Incus versions prior to 6.23.0 (CVE-2026-33945) allows an attacker to write arbitrary files as root, leading to privilege escalation and denial of service by crafting a malicious systemd credential path.Incus, a system container and virtual machine manager, is susceptible to a critical vulnerability (CVE-2026-33945) affecting versions prior to 6.23.0. The vulnerability resides in the handling of systemd credentials passed to guest containers. An attacker can exploit this by crafting a configuration key (e.g., systemd.credential.../../../../../../root/.bashrc) containing path traversal sequences, causing Incus to write outside the intended credentials directory. This occurs because Incus insufficiently validates the systemd.credential.XYZ syntax, allowing the XYZ portion to include periods and traverse the filesystem. While direct data reading is prevented, the ability to write arbitrary files as root grants attackers privilege escalation and denial-of-service capabilities. Users should upgrade to version 6.23.0 or later to mitigate this risk.

Attack Chain

1. Attacker identifies an Incus instance running a version prior to 6.23.0.
2. The attacker gains access to the Incus instance, potentially through existing vulnerabilities or compromised credentials.
3. Attacker crafts a malicious configuration key using the systemd.credential.XYZ syntax, embedding path traversal sequences (e.g., systemd.credential.../../../../../../root/.bashrc).
4. The attacker sets the crafted configuration key within the Incus instance's configuration.
5. Incus attempts to write the systemd credential data to the specified path, which, due to the path traversal, resolves to an arbitrary location on the host filesystem.
6. The attacker overwrites a critical system file (e.g., .bashrc, /etc/passwd) with malicious content, leveraging root privileges.
7. The attacker triggers the execution of the overwritten file (e.g., by logging in as root, starting a new shell, or restarting a service).
8. The attacker gains escalated privileges or causes a denial of service.

Impact

Successful exploitation of CVE-2026-33945 allows attackers to gain root privileges on the Incus host system. This can lead to complete system compromise, including data theft, modification, or destruction. Furthermore, attackers can leverage this vulnerability to cause a denial of service by overwriting critical system files. The severity is high due to the ease of exploitation and the potential for significant impact on affected systems. While there is no public report on the number of victims, any organization using vulnerable versions of Incus is potentially at risk.

Recommendation

• Upgrade Incus to version 6.23.0 or later to patch CVE-2026-33945.
• Implement filesystem monitoring for unexpected writes to sensitive system directories (e.g., /root, /etc) to detect potential exploitation attempts. Deploy the provided Sigma rule to detect suspicious file modifications.
• Enable audit logging on Incus configuration files to monitor for unauthorized changes. Deploy the provided Sigma rule to detect unauthorized changes to incus configuration files.

]]>criticaladvisoryincuspath-traversalprivilege-escalationdenial-of-serviceCVE-2026-33945linuxhttps://feed.craftedsignal.io/briefs/2024-01-incus-auth-bypass/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-incus-auth-bypass/Incus versions prior to 6.23.0 are vulnerable to an authentication bypass in the `incus webui` component, allowing local attackers to gain elevated privileges or remote attackers to access system resources by exploiting the incorrect validation of authentication tokens.Incus is a system container and virtual machine manager. Prior to version 6.23.0, the incus webui component contains an authentication bypass vulnerability (CVE-2026-33898). The vulnerability lies in the incorrect validation of authentication tokens by the web server spawned by incus webui. incus webui launches a local web server on a randomly assigned localhost port and issues a URL containing an authentication token for user access. While the Incus client correctly validates cookies, it fails to properly validate tokens passed directly in the URL. This flaw can be exploited by an attacker able to communicate with the temporary web server on localhost. Successful exploitation grants the attacker the same privileges as the user who initiated incus webui. This impacts system security as it may lead to privilege escalation or unauthorized access to Incus instances and potentially system resources. The vulnerability is resolved in Incus version 6.23.0.

Attack Chain

1. A user initiates the incus webui command, which spawns a temporary web server on a random localhost port (e.g., 127.0.0.1:8080).
2. Incus provides the user with a URL containing an authentication token (e.g., http://127.0.0.1:8080/?token=abcdef123456).
3. An attacker gains access to the network or system where the Incus webui is running, and identifies the localhost port being used.
4. The attacker crafts a malicious request to the incus webui web server, using a valid or even an invalid token in the URL. The vulnerability does not properly validate the token.
5. Due to the authentication bypass, the attacker is granted access to the Incus webui with the privileges of the user who started the incus webui instance.
6. If the attacker is a local user, they can leverage their newly acquired privileges to escalate their access to the system.
7. The attacker could manipulate Incus instances, access sensitive data, or potentially gain control of underlying system resources.
8. The attacker achieves privilege escalation or unauthorized access, depending on the attacker's initial location and goals.

Impact

Successful exploitation of CVE-2026-33898 allows an attacker to gain the privileges of the user running incus webui. If the attacker is a local user, this results in privilege escalation, allowing them to perform actions they were previously unauthorized to do. A remote attacker who can trick a local user into interacting with the Incus web UI server could gain unauthorized access to Incus instances and potentially sensitive system resources. The CVSS v3.1 base score for this vulnerability is 8.8, indicating a high severity.

Recommendation

• Upgrade Incus to version 6.23.0 or later to patch the vulnerability (CVE-2026-33898).
• Implement network segmentation to restrict access to the incus webui web server.
• Monitor network connections to the incus webui web server for suspicious activity (see the network connection Sigma rule below).
• Audit the use of incus webui in your environment and restrict its use to authorized personnel only.

]]>highadvisorycve-2026-33898privilege-escalationauthentication-bypasslinux