CVE-2019-4116

Vulnerability

IBM Cloud Private versions 2.1.x, 3.1.0, and 3.1.1 store highly sensitive information in installer logs, including credentials and configuration details. This exposure occurs when logs are retained after installation or upgrade, allowing any user with local access to read the log files [1].

Exploitation

An attacker with low-privileged local access to the boot node can retrieve sensitive information by accessing Docker exited containers and the cluster/logs directory. The attacker does not require user interaction and can execute a series of commands to collect the logs [1].

Impact

Successful exploitation leads to disclosure of highly sensitive data, which may include authentication tokens, passwords, and infrastructure details. This information can then be leveraged in further attacks against the system, resulting in a high confidentiality impact with no direct integrity or availability impact [1].

Mitigation

IBM recommends upgrading to version 3.1.2 or 3.2.0. As an immediate workaround, remove all exited Docker containers using docker rm $(docker ps -f status=exited) and delete the cluster/logs directory contents with rm -rf /path/to/cluster/logs/* [1].