A pool-operator can inject arbitrary static routes into the host routing table by setting Network.other_config:static-routes to attacker-controlled subnet/gateway pairs. The value is parsed by nm.ml:469-489 and applied directly to the bridge interface with no validation on subnet, gateway reachability, or conflicts with existing routes. Injected routes can redirect storage network traffic, management traffic, or cloud subnet traffic through an attacker-controlled gateway, enabling man-in-the-middle attacks on infrastructure communications.
Network.other_config is a Map(String, String) field writable by pool-operator. The static-routes key is consumed by the network manager daemon (xcp-networkd) to add routes to the bridge interface associated with the network.
pool-operator calls Network.add_to_other_config(net, "static-routes", "10.0.0.0/8/192.168.1.100")
-> nm.ml:469-489 parses the static-routes value
-> Route entries extracted as subnet/gateway pairs
-> ip route add 10.0.0.0/8 via 192.168.1.100 dev <bridge>
-> All traffic matching 10.0.0.0/8 now routes through attacker gateway
The static-routes value is a comma-separated list of entries in the format subnet/mask/gateway. Each entry is parsed and applied as a static route on the bridge interface. No validation occurs:
Missing RBAC protection. Network.other_config has zero map_keys_roles entries for the static-routes key.
No route validation. Routes are applied without checking for conflicts with management, storage, or HA heartbeat networks.
No gateway reachability check. The gateway address is not validated as reachable on the bridge subnet.
Immediate effect. Routes take effect immediately on the host, redirecting traffic without confirmation or delay.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Storage traffic redirection | Storage I/O routed through attacker gateway | Storage on routable subnet | Modeled (code-traced) |
| Management traffic MITM | API and management traffic intercepted | Management on affected bridge | Modeled |
| Combined with SMC-1 | Route + protocol injection for complete storage control | SMC-1 available | Modeled (chain) |
| BOC-1 chain | vm-admin escalates to pool-operator via BOC-1 S3, then injects routes | BOC-1 available | Modeled (two-step chain) |
Network.other_config for writes to static-routesdisclosure/vendor-detection-guidance.mdNetwork.other_config records for unexpected static-routes valuespool-operator role to trusted administratorsRBAC restriction. Add map_keys_roles entry for static-routes in datamodel.ml requiring _R_POOL_ADMIN.
Route validation. Validate injected routes against management, storage, and HA network ranges. Reject routes that would conflict with infrastructure-critical traffic paths.
Gateway validation. Verify that the gateway address is reachable on the bridge subnet before applying the route.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
nm.ml:469-489 (static-routes parsing and application), datamodel.ml (Network field definition)disclosure/advisories/noc-security-advisory.md (NOC-3)research/investigations/network-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.