Отправить #1044005: Magma Magma 1.8.0-era master @ 76d9dc0ebc (tested); every deployment Hard-coded Credentials

================================================================================
REPORT ID : MAGMA-2026-003
CHAIN ROOT : MAGMA-2026-001 (#1043997) - Host Routes RBAC Bypass
TITLE : Hardcoded gRPC client-certificate token in Orc8r interceptors
VENDOR : Magma (Linux Foundation)
PRODUCT : Magma Orc8r (controller)
COMPONENT : orc8r/lib/go/registry/interceptors.go,
orc8r/lib/go/registry/identity_decorator.go
CWE : CWE-798 Use of Hard-coded Credentials
GHSA : GHSA-vwm9-4rf4-xfwx (private)
CVSS 3.1 : 8.8 HIGH
CVSS 4.0 : 7.7 HIGH
REPORTER : Aymen Benlamari (GitHub: aymencdm)
AFFECTED : Magma 1.8.0-era master @ 76d9dc0ebc (tested); every deployment
that does not override the value
EMBARGO : 2026-11-09
RELATED : MAGMA-2026-001 (#1043997) (chain root), MAGMA-2026-004 (serial abuse),
MAGMA-2026-005 (chain)
================================================================================

--------------------------------------------------------------------------------
0. CHAIN RELATIONSHIP
--------------------------------------------------------------------------------
This finding is the second step of the chain described in MAGMA-2026-005:

MAGMA-2026-001 role=0 host-org user -> NMS SUPERUSER
MAGMA-2026-003 hardcoded token -> dump Orc8r operator certificate serials
MAGMA-2026-004 certificate header spoofing -> full Orc8r REST API

MAGMA-2026-001 is the chain root and explains how an external attacker can
obtain a network position from which the Orc8r services are reachable. This
finding is nevertheless a standalone defect: it requires only network access to
the internal gRPC ports (pod compromise, SSRF, sidecar, or a compromised NMS
container) and does not depend on the RBAC bypass. The token is identical in
every Magma deployment that has not set the override.

--------------------------------------------------------------------------------
1. SUMMARY
--------------------------------------------------------------------------------
Orc8r's gRPC identity decorator accepts a static, hardcoded string as the value
of the x-magma-client-cert-serial metadata header and treats it as an
authenticated internal client. The value is a compile-time constant:

7ZZXAF7CAETF241KL22B8YRR7B5UF401

It is the same in every Magma deployment. Anyone who can reach the internal
gRPC services and knows this public constant bypasses certificate validation on
certifier, accessd, configurator and state services. From there an attacker can
dump every operator certificate serial (including admin_operator), enumerate
ACLs, read gateway state and modify Orc8r configuration.

--------------------------------------------------------------------------------
2. AFFECTED COMPONENT / VERSIONS
--------------------------------------------------------------------------------
Product : Magma Orc8r (Go controller)
Files : orc8r/lib/go/registry/interceptors.go:30 (constant)
orc8r/lib/go/registry/identity_decorator.go:142-146 (comparison)
Services : certifier (9186), accessd (9191), configurator, state
Tested on : master @ 76d9dc0ebc (Magma 1.8.0-era), Docker lab with TLS disabled
Likely : every release that contains the constant. Because the token is
global and stable, one leaked value works across deployments.

--------------------------------------------------------------------------------
3. ROOT CAUSE
--------------------------------------------------------------------------------
orc8r/lib/go/registry/interceptors.go:30 defines:

const ORC8R_CLIENT_CERT_VALUE = "7ZZXAF7CAETF241KL22B8YRR7B5UF401"

orc8r/lib/go/registry/identity_decorator.go:142-146 performs:

if sn == registry.ORC8R_CLIENT_CERT_VALUE {
return newCtx, nil // bypasses all cert/identity checks
}

The decorator normally validates a client certificate serial against the
certifier. The equality check short-circuits that validation for a value that is
public, static and identical everywhere. It is not a secret, not per-deployment,
not rotatable, and not tied to any identity. It is a universal bearer token.

The design problem is that the value is a compile-time constant in a public
repository, is identical in every deployment, is not rotatable, and is not tied
to any identity.

--------------------------------------------------------------------------------
4. ATTACKER MODEL / PRECONDITIONS
--------------------------------------------------------------------------------
- Network access to the Orc8r internal gRPC ports. In the tested lab this is the
Docker bridge; in production it is the cluster network. The attacker does not
need a client certificate or an operator account.
- Knowledge of the constant, which is in the public source tree.
- For the certifier dump, no other privilege is required. For configurator
writes, the same token is accepted.

This is not directly reachable from the public internet in a correctly
segmented deployment. It becomes reachable through the RBAC chain
(MAGMA-2026-001), a compromised pod, an SSRF in a co-located service, or any
sidecar that shares the network namespace. The reporter treats the internal
network position as an attack requirement, not as a mitigation.

--------------------------------------------------------------------------------
5. IMPACT
--------------------------------------------------------------------------------
With the token, an attacker can:

- certifier.GetAll: dump every certificate serial and operator identity,
including admin_operator. This directly enables MAGMA-2026-004.
- accessd.ListOperators / GetOperatorACL: enumerate operators and their ACLs.
- configurator.CreateEntities / UpdateEntities: create or modify Orc8r
configuration for networks, gateways and services.
- state.ReadState: read gateway and service state.
- Disrupt services by modifying or deleting configuration.

Confidentiality, integrity and availability are High within Orc8r. The token
does not by itself cross into another security authority, so scope is Unchanged.

--------------------------------------------------------------------------------
6. CVSS 3.1 - 8.8 HIGH
--------------------------------------------------------------------------------
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metric Value Why
------ ----- ----------------------------------------------------------------
AV A The gRPC ports are reachable from an adjacent network (the
cluster/Docker network), not from the public internet in a
correctly segmented deployment. AV:A reflects that position.
AC L A single gRPC call with a static header value. No race, no
crypto work, no special conditions.
PR N The token is a universal credential; no account or certificate
is required.
UI N No user interaction.
S U The vulnerable component and the impacted services are all
within the Orc8r deployment / same security authority.
C H Full read of certificate serials, ACLs and state.
I H Configuration and entities can be created or modified.
A H Configuration can be deleted or disrupted.

Note: an earlier draft scored this 8.0. The vector above computes to 8.8 in
CVSS 3.1. 8.8 is used throughout this package.

--------------------------------------------------------------------------------
7. CVSS 4.0 - 7.7 HIGH
--------------------------------------------------------------------------------
Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Metric Value Why
------ ----- ----------------------------------------------------------------
AV A Adjacent network (cluster/Docker network).
AC L Deterministic single call with a known header.
AT P Attack requirements are present: the attacker must first obtain
a position on the internal network (pod, SSRF, sidecar, or the
RBAC chain). This is why the 4.0 score is lower than 3.1's 8.8.
PR N No account or certificate.
UI N No user interaction.
VC H Certificate serials, ACLs and state are readable.
VI H Configuration can be changed.
VA H Services/configuration can be disrupted.
SC N No subsequent system beyond Orc8r.
SI N Same.
SA N Same.

If the reviewer treats internal reachability as part of the vulnerable
configuration rather than an attack requirement, set AT:N; the score becomes
8.7. The AT:P reading is the conservative one and matches the reporter's
stated attacker model.

--------------------------------------------------------------------------------
8. PROOF OF CONCEPT - GRPCURL COMMANDS
--------------------------------------------------------------------------------
Prerequisites: grpcurl and the Magma proto files. The commands below assum

• Пользователь: aymencdm (UID 101800)
• Представление: 19.10.2026 22:09 (26 дни назад)
• Модерация: 14.11.2026 07:50 (25 days later)
• Статус: принято
• Запись VulDB: 437422 [Linux Foundation Magma до 1.9.0 interceptors.go слабая аутентификация]
• Баллы: 17