CVE-2024-47533
Published: 18 November 2024
Summary
CVE-2024-47533 is a critical-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Cobbler, a Linux installation server used for rapid setup of network installation environments, contains an improper authentication vulnerability (CVE-2024-47533, CWE-287) affecting versions 3.0.0 through 3.2.2 and 3.3.0 through 3.3.6. The root cause is that utils.get_shared_secret() unconditionally returns the value -1, which permits unauthenticated connections to the Cobbler XML-RPC interface using an empty username and the password -1.
An attacker with network access to an affected Cobbler server can exploit the flaw to authenticate as the empty user, invoke any XML-RPC methods, and thereby obtain complete administrative control over the server, including the ability to modify all configuration and provisioning data. The CVSS 3.1 score of 9.8 reflects the absence of required credentials or user interaction and the full confidentiality, integrity, and availability impact.
Patches released in Cobbler 3.2.3 and 3.3.7 correct the shared-secret handling, as described in the project’s GitHub security advisory GHSA-m26c-fcgh-cp6h and the corresponding commits that restore proper authentication checks. The EPSS score has reached 0.7247 without a documented low-to-high trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3281
Vulnerability details
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to…
more
cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.
Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.