Plattform
linux
Komponente
maas
Behoben in
3.1.4
3.2.11
3.3.8
3.4.4
3.5.1
CVE-2024-6107 is a critical vulnerability affecting MAAS versions 3.1.0 through 3.5.1. This flaw stems from insufficient verification, enabling a malicious client to bypass authentication checks and execute Remote Procedure Call (RPC) commands within a region. Successful exploitation grants an attacker unauthorized control, potentially leading to significant system compromise. A fix is available in version 3.5.1.
The impact of CVE-2024-6107 is severe. An attacker who successfully exploits this vulnerability can gain complete control over a region within the MAAS environment. This includes the ability to provision, modify, and delete virtual machines and bare metal servers, effectively compromising the entire infrastructure managed by MAAS. The attacker could also potentially leverage this access to move laterally within the network, depending on the configuration and access controls in place. The blast radius extends to all systems managed by the affected MAAS region.
CVE-2024-6107 has been published on 2025-07-21. The EPSS score is likely to be high given the critical CVSS score and the potential for remote, unauthenticated exploitation. Public proof-of-concept code is not currently available, but the vulnerability's nature suggests it could be relatively easy to exploit. Monitor CISA and vendor advisories for further updates and potential exploitation campaigns.
Organizations heavily reliant on MAAS for automated server provisioning and management are at significant risk. Specifically, those using older versions (3.1.0–3.5.1) and those with less stringent network security controls are particularly vulnerable. Shared hosting environments utilizing MAAS for resource allocation also face increased exposure.
• linux / server:
journalctl -u maas -g "authentication failure"• linux / server:
ps aux | grep -i rpc• linux / server:
ss -lptn 'dst :80' # Check for unusual connections to RPC portsdisclosure
Exploit-Status
EPSS
0.10% (28% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-6107 is to upgrade to MAAS version 3.5.1 or later. If immediate upgrade is not feasible, consider implementing stricter network segmentation to limit the potential impact of a successful attack. Review and harden RPC access controls within the MAAS environment. Monitor MAAS logs for suspicious activity, particularly related to RPC calls and authentication attempts. While a direct WAF rule is unlikely, consider rules that restrict access to RPC endpoints from untrusted sources. After upgrading, confirm the fix by attempting to authenticate with a malicious client and verifying that authentication is rejected.
Actualice MAAS a la versión corregida que incluye la solución para la verificación insuficiente. Esto evitará que atacantes remotos ejecuten comandos RPC no autorizados. Consulte las notas de la versión de MAAS para obtener detalles específicos sobre la actualización.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-6107 is a critical vulnerability in MAAS versions 3.1.0 through 3.5.1 that allows attackers to bypass authentication and execute RPC commands, potentially gaining control of managed regions.
If you are running MAAS versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, or 3.5.0, you are vulnerable to this RPC bypass vulnerability. Check your version immediately.
Upgrade to MAAS version 3.5.1 or later to address this vulnerability. If immediate upgrade is not possible, implement network segmentation and monitor logs.
While no active exploitation has been publicly confirmed, the critical severity and ease of potential exploitation suggest it is a high-priority risk. Monitor for updates.
Refer to the official MAAS security advisories on the Canonical website for detailed information and updates regarding CVE-2024-6107.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.