CVE-2024-55582

Executive Summary

CVE-2024-55582 identifies a critical security flaw in Oxide, a cloud infrastructure platform, where the Control Plane datastores are stored without encryption. This vulnerability allows an attacker with local access to the Oxide host to read sensitive configuration data, credentials, and operational secrets in plaintext. The CVSS score of 5.7 reflects a medium severity due to the requirement of local access, but the potential impact on confidentiality and integrity is high. As of this report, no patch is available, and the vendor has been notified.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but affects the Oxide platform itself. The risk is primarily to organizations deploying Oxide in their infrastructure, where an attacker with local access could compromise the entire control plane.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires physical or logical access to the host.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Attacker needs administrative access to the host.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full disclosure of all datastore contents.
• Integrity (I): High (H) – Datastore can be modified.
• Availability (A): High (H) – Datastore can be deleted or corrupted.

Threat Level: Medium (5.7) – Exploitation requires high privileges, but impact is severe.

Deep Dive & Mechanics

The Oxide Control Plane is responsible for managing cloud resources, including virtual machines, networks, and storage. It relies on datastores (e.g., PostgreSQL, CockroachDB, or custom key-value stores) to persist state. In vulnerable versions, these datastores are configured without encryption at rest, meaning all data is stored in plaintext on disk.

An attacker who gains root or administrative access to the Oxide host (e.g., via a compromised SSH key, physical access, or another vulnerability) can directly read the datastore files. This exposes:

• API keys and tokens
• User credentials (hashed or plaintext)
• VM metadata and secrets
• Network configuration and firewall rules
• Audit logs

The vulnerability is rooted in the default configuration of the Oxide deployment scripts, which omit encryption settings for the datastore. No authentication bypass or remote exploitation is possible; the attack vector is purely local.

Vulnerable vs. Patched Code

Vulnerable Configuration (example):

# /etc/oxide/datastore.yaml
datastore:
  type: postgresql
  host: localhost
  port: 5432
  database: oxide_control
  username: oxide_admin
  password: plaintext_password
  ssl: false
  encryption: none

Patched Configuration (expected):

# /etc/oxide/datastore.yaml
datastore:
  type: postgresql
  host: localhost
  port: 5432
  database: oxide_control
  username: oxide_admin
  password: encrypted_password
  ssl: true
  encryption: aes-256-gcm

The patch would require:

1. Enabling TLS for datastore connections.
2. Enabling encryption at rest (e.g., using LUKS or filesystem-level encryption).
3. Storing credentials in a secrets manager (e.g., HashiCorp Vault) instead of plaintext.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to the Oxide host with root privileges.
• Knowledge of the datastore location (default: /var/lib/oxide/datastore/).

Exploitation Steps:

1. Gain root access via SSH, physical console, or privilege escalation.
2. Locate the datastore files:

   find /var/lib/oxide -type f -name "*.db" -o -name "*.sqlite" -o -name "*.pgsql"
   

3. Read the datastore contents:

   sqlite3 /var/lib/oxide/datastore/control.db "SELECT * FROM credentials;"
   

4. Extract sensitive data and pivot to other systems.

Lab Setup:

• Deploy a vulnerable Oxide instance (version < 6) in a VM.
• Create a non-root user with sudo privileges.
• Simulate an attacker gaining root access via a misconfigured SSH key.

Blue Team

Detection:

• Monitor for unauthorized access to /var/lib/oxide/datastore/.
• Alert on processes reading datastore files (e.g., sqlite3, cat, strings).
• Use file integrity monitoring (FIM) to detect changes to datastore files.

Mitigation:

• Immediately rotate all credentials stored in the datastore.
• Enable encryption at rest using LUKS or similar.
• Restrict access to the Oxide host using network segmentation and least privilege.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/lib/oxide/datastore/control.db
  • /var/lib/oxide/datastore/network.db
  • /var/lib/oxide/datastore/audit.log
• Process Names:
  • sqlite3
  • strings
  • cat (when reading datastore files)
• Network Connections:
  • Unexpected outbound connections from the Oxide host to external IPs (data exfiltration).
• Log Entries:
  • ERROR: Unencrypted datastore access detected (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_55582_Oxide_Unencrypted_Datastore {
    meta:
        description = "Detects unencrypted Oxide Control Plane datastore files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55582"
    strings:
        $s1 = "plaintext_password" ascii wide nocase
        $s2 = "encryption: none" ascii wide nocase
        $s3 = "ssl: false" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Oxide Control Plane Unencrypted Datastore Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to read Oxide datastore files without encryption
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/sqlite3'
            - '/strings'
            - '/cat'
        CommandLine|contains:
            - '/var/lib/oxide/datastore/'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55582 - Oxide Datastore Exfiltration"; flow:to_server,established; content:"|0a|"; depth:1; content:"SELECT"; nocase; content:"FROM credentials"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Oxide host from untrusted networks.
2. Rotate all credentials stored in the datastore.
3. Enable filesystem-level encryption (e.g., LUKS) on the datastore partition.
4. Apply the vendor patch once released.

Long-term Fixes:

• Reconfigure the datastore to use TLS and encryption at rest.
• Implement a secrets management solution (e.g., HashiCorp Vault).
• Conduct a security audit of all Oxide deployments.

Workarounds:

• Use a separate encrypted volume for the datastore.
• Restrict access to the Oxide host using SSH key-based authentication and MFA.

Valters IT