Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

Overview

Summary

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.

While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints.

Proof of Concept

The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and validate_auth_token in lib/rucio/core/authentication.py accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token:

1. Request a challenge token for an arbitrary account (e.g., "root"): curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token
2. The server returns a 200 OK with the header X-Rucio-SSH-Challenge-Token.
3. The attacker can then use this specific token within the ten-second challenge lifetime as an authentication credential in subsequent requests to the Rucio API: curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN" https://rucio/accounts/whoami

Affected packages

• rucio >= 1.14.0.post1, < 35.9.1
• rucio >= 36.0.0rc1, < 38.6.1
• rucio >= 39.0.0rc1, < 40.4.2
• rucio >= 41.0.0rc1, < 41.1.1

Remediation

Upgrade to a patched release:

• rucio 35.9.1
• rucio 38.6.1
• rucio 40.4.2
• rucio 41.1.1