CVE-2024-28716

Executive Summary

CVE-2024-28716 is a critical vulnerability in OpenStack Storlets, specifically within the gateway.py component. The vulnerability allows a remote attacker to execute arbitrary code, posing a severe risk to the confidentiality, integrity, and availability of affected systems. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The exact affected version is unknown, but the advisory mentions "yoga-eom" as a potentially affected release. No public proof-of-concept (PoC) or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects OpenStack Storlets, a component of the OpenStack ecosystem. Organizations using OpenStack deployments with Storlets enabled should treat this as a high-priority security issue. The lack of a patch and public exploit details increases the risk of targeted attacks.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that the NVD has not yet assigned a score. However, based on the description (remote code execution), the likely CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. Remote code execution without authentication.

Deep Dive & Mechanics

The vulnerability resides in the gateway.py component of OpenStack Storlets. The exact mechanism is not publicly disclosed, but it is likely a code injection flaw where user-supplied input is improperly sanitized and passed to a function that evaluates or executes code (e.g., eval(), exec(), or similar). An attacker can craft a malicious request to the gateway endpoint, injecting arbitrary Python code that is then executed in the context of the Storlets service.

The attack surface is the network-facing gateway service, which typically listens on a TCP port (e.g., 8080 or 8443). The attacker does not need authentication, making this a pre-authentication remote code execution vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison cannot be made. However, the vulnerable code likely contains a pattern similar to:

# Vulnerable code (hypothetical)
def process_request(request):
    data = request.get('data')
    result = eval(data)  # Unsafe eval of user input
    return result

A patched version would sanitize input or avoid using eval():

# Patched code (hypothetical)
def process_request(request):
    data = request.get('data')
    # Use safe parsing or validation
    sanitized_data = sanitize(data)
    result = safe_function(sanitized_data)
    return result

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy an OpenStack environment with Storlets enabled (e.g., using DevStack).
2. Identify the gateway service IP and port (default: 10.0.0.1:8080).
3. Craft a malicious payload to exploit the code injection.

Exploit Example (Hypothetical):

import requests

target = "http://10.0.0.1:8080/gateway"
payload = "__import__('os').system('id')"  # Example payload

response = requests.post(target, json={"data": payload})
print(response.text)

Expected Output: The command id would be executed on the server, returning the user ID.

Blue Team

Detection:

• Monitor for unusual POST requests to the /gateway endpoint.
• Look for payloads containing Python built-in functions like __import__, eval, exec, os.system, etc.
• Enable Web Application Firewall (WAF) rules to block common code injection patterns.

Hunting:

• Search logs for requests with data parameter containing suspicious strings.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /gateway with JSON body containing __import__, eval, exec, or os.system.
  • Outbound connections from the Storlets service to attacker-controlled IPs (if reverse shell is used).
• File System:
  • Unexpected files in /tmp/ or /var/tmp/ created by the Storlets user.
  • Modified system binaries or scripts.
• Process:
  • Unusual child processes spawned by the Storlets service (e.g., /bin/sh, /bin/bash).

Detection Engineering

YARA Rule

rule CVE_2024_28716_CodeInjection {
    meta:
        description = "Detects code injection attempts targeting OpenStack Storlets gateway.py"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28716"
    strings:
        $s1 = "__import__" nocase
        $s2 = "eval(" nocase
        $s3 = "exec(" nocase
        $s4 = "os.system" nocase
        $s5 = "subprocess" nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-28716 OpenStack Storlets Code Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-28716 via HTTP POST requests to gateway.py
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/gateway'
        cs-uri-query|contains: 
            - '__import__'
            - 'eval('
            - 'exec('
            - 'os.system'
    condition: selection
falsepositives:
    - Legitimate use of Python in development environments (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28716 OpenStack Storlets Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/gateway"; http_uri; content:"__import__"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Storlets service from untrusted networks (e.g., place behind a firewall or VPN).
2. Disable the gateway service if not required.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Await an official patch from OpenStack. Once available, apply immediately.
• Implement input validation and sanitization in the gateway code.
• Use a Web Application Firewall (WAF) to block malicious payloads.

Workaround:

• Restrict access to the gateway endpoint using network ACLs or authentication proxies.

Valters IT