CVE-2021-43415: Improper Authentication in HashiCorp Nomad

Background

HashiCorp Nomad is an open-source cluster manager and scheduler designed for microservices and batch applications. It allows users to deploy and manage applications across a distributed infrastructure. Nomad supports various task drivers, including the QEMU task driver, which enables running virtual machines as tasks. This vulnerability affects Nomad versions up to 1.0.13, 1.1.7, and 1.2.0 when the QEMU task driver is enabled.

Vulnerability Detail

The vulnerability in HashiCorp Nomad allows authenticated users with job submission capabilities to bypass the configured allowed image paths when using the QEMU task driver. This means that an attacker with the ability to submit jobs can execute arbitrary code by specifying an unauthorized image path. The impact of this vulnerability is high, as it allows unauthorized code execution within the Nomad environment.

go get github.com/hashicorp/nomad@v1.11.3

Workaround

As a workaround, users can disable the QEMU task driver if it is not required for their deployments. This can be done by modifying the Nomad configuration to remove or comment out the QEMU task driver configuration. Here is an example of how to disable the QEMU task driver:

task "example" {
  driver = "docker"
  config {
    image = "example/image"
  }
}

In the above configuration, the QEMU task driver is replaced with the Docker task driver. This ensures that only authorized Docker images can be used.

Conclusion

The vulnerability in HashiCorp Nomad allows authenticated users to bypass image path restrictions and execute unauthorized code when using the QEMU task driver. To mitigate this issue, it is crucial to upgrade to the latest patched versions of Nomad. Additionally, disabling the QEMU task driver can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/hashicorp/nomad →

FAQ