CVE-2018-10931

Vulnerability

Cobbler versions 2.6.x expose all functions from the CobblerXMLRPCInterface class over the XMLRPC endpoint (/cobbler_api). The implementation uses Python's SimpleXMLRPCServer with register_instance, which makes every method of that class accessible remotely without authentication [2]. This includes over 195 methods, some of which were intended to be private (e.g., _new_event, _set_task_state, _log) [2]. The design flaw means that no access token is validated for many endpoints, effectively rendering the API unauthenticated [2].

Exploitation

A remote, unauthenticated attacker can connect to the exposed XMLRPC endpoint and call any method from the CobblerXMLRPCInterface class [1][2]. No prior authentication or user interaction is required. The attacker can directly invoke methods that modify settings, upload files, or perform privileged operations. For example, the modify_setting API endpoint lacked proper token checks, which a pull request later addressed [3]. The attacker only needs network access to the Cobbler server (typically on port 80/443 or a custom port) [2].

Impact

Successful exploitation allows the attacker to gain high privileges within Cobbler, potentially equivalent to an administrator [1][4]. The attacker can upload files to arbitrary locations on the server file system, in the context of the Cobbler daemon [1]. This could lead to remote code execution, unauthorized configuration changes, or complete compromise of the Cobbler server and its managed infrastructure.

Mitigation

Red Hat released advisory RHSA-2018:2372, which provides updated packages for Red Hat Enterprise Linux and other affected distributions [4]. Users should upgrade to the patched version of Cobbler. For environments where immediate patching is not possible, restrict network access to the /cobbler_api endpoint using a firewall or reverse proxy to limit exposure to trusted networks only [2]. The fix ensures proper access token validation on critical API methods such as modify_setting [3].