MOKSHA-2026-0035: iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread (xapi_host_helpers.ml:584-595) syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. If storage targets use IQN-based access control lists - the standard access control mechanism for enterprise iSCSI deployments - the attacker gains unauthorized access to LUNs belonging to other hosts or tenants. This directly amplifies SMC-1: the attacker controls both the initiator identity (HOC-2) and the target parameters (SMC-1).

Vulnerability Description

Host.other_config is a Map(String, String) field writable by pool-operator. The iscsi_iqn key is consumed by the XAPI event watcher thread, which writes the value directly to the host's iSCSI initiator name file.

The code path:

1. pool-operator calls Host.add_to_other_config(host, "iscsi_iqn", "iqn.2001-01.com.victim:storage1")
2. The XAPI event watcher thread detects the change (xapi_host_helpers.ml:584-595)
3. The value is written to /etc/iscsi/initiatorname.iscsi without validation
4. All subsequent iSCSI discovery and login operations use the spoofed IQN
5. Storage arrays that rely on IQN-based ACLs grant access based on the spoofed identity

No format validation is performed. The value is not checked against RFC 3720 IQN format. Arbitrary strings are accepted.

Root Causes

1. Missing RBAC protection. Host.other_config has zero map_keys_roles entries for iscsi_iqn. The key inherits the class default _R_POOL_OP.

2. Missing format validation. The IQN value is not validated against RFC 3720 format. Any string is accepted and written to the initiator name file.

3. Host identity file as writable config. The iSCSI initiator name file (/etc/iscsi/initiatorname.iscsi) is the host's identity in all iSCSI protocol interactions. It should not be modifiable through a user-writable map field.

4. Scope change to storage network. The spoofed IQN affects resources outside the hypervisor trust boundary - specifically, storage array ACLs and LUN mappings.

Affected Systems

Directly Affected

• XenServer / Citrix Hypervisor - all versions (shared XAPI codebase)
• XCP-ng - all versions (confirmed on 8.3.0, iscsi_iqn key verified)

Indirectly Affected

• iSCSI storage arrays (NetApp, Dell EMC, Pure, HPE, etc.) - ACLs bypassed via IQN spoofing
• Multi-tenant iSCSI SANs - tenant isolation broken by initiator impersonation
• Storage compliance systems - access logs show the spoofed identity, corrupting audit trails

Exploitation Scenarios

Chaining Analysis

HOC-2 chains with BOC-1 and SMC-1:

• BOC-1 + HOC-2: vm-admin uses BOC-1 S3 to self-grant pool-operator, then spoofs the iSCSI initiator identity. The effective privilege drops from pool-operator to vm-admin.
• HOC-2 + SMC-1: Attacker controls both the initiator identity (which host the storage array thinks is connecting) and the target parameters (which storage target the host connects to). Combined control of both ends of the iSCSI session.

Detection

• Monitor Host.other_config for iscsi_iqn modifications outside planned maintenance
• Compare the value in Host.other_config:iscsi_iqn against /etc/iscsi/initiatorname.iscsi on each host
• Alert on iSCSI initiator name changes in storage array access logs
• Monitor /etc/iscsi/initiatorname.iscsi for unauthorized modifications

Remediation

Short-Term Mitigations

• Audit Host.other_config:iscsi_iqn on all pool hosts
• Verify /etc/iscsi/initiatorname.iscsi matches expected values
• Restrict pool-operator role grants to trusted administrators

Long-Term Fix

Validate IQN format. Enforce RFC 3720 IQN format validation at write time. Reject values that do not conform to the iqn.YYYY-MM.domain:identifier pattern.

Add map_keys_roles. Protect iscsi_iqn in datamodel_host.ml at _R_POOL_ADMIN to prevent pool-operator from modifying the host's iSCSI identity.

Immutable host identity. The iSCSI initiator name should be set once during host installation and not modifiable through the API without explicit pool-admin authorization.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

• Public release: 2026-04-24 08:00 CEST
• CERT/CC notified: 2026-04-23
• MITRE CVE reservation filed: 2026-04-09 (no response as of publication)
• EU CVE registers notified: 2026-04-18 (GCVE/CIRCL, ENISA, DIVD - no response)
• Vendor (Cloud Software Group / Citrix): not contacted pre-publication
• Downstream maintainer (Vates/XCP-ng): contacted 2026-04-23 with conditional patch offer

References

• XAPI source: datamodel_host.ml:2929-2934 (field definition), xapi_host_helpers.ml:584-595 (event watcher sync to initiator name file)
• Thematic advisory: disclosure/advisories/hoc-security-advisory.md (HOC-2)
• Investigation: research/investigations/host-other-config.md

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.