CVE-2024-0822: Ovirt Engine Auth Bypass Vulnerability

CVE-2024-0822 Overview

CVE-2024-0822 is an authentication bypass vulnerability in oVirt Engine (ovirt-engine), an open-source virtualization management platform. The flaw resides in the CreateUserSession command, which fails to enforce authentication before processing user creation requests. Remote attackers can exploit this weakness over the network without credentials or user interaction to create users in the system. The vulnerability impacts the integrity of the virtualization management plane and undermines access control assumptions made by downstream components. Red Hat tracks this issue under RHSA-2024:0934 and Bugzilla #2258509.

Critical Impact
Unauthenticated remote attackers can create arbitrary user accounts in oVirt Engine, compromising the integrity of virtualization infrastructure management.

Affected Products

oVirt Engine (ovirt:ovirt-engine)
Red Hat Virtualization deployments referencing the upstream oVirt Engine component
Downstream distributions packaging the vulnerable CreateUserSession command path

Discovery Timeline

2024-01-25 - CVE-2024-0822 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0822

Vulnerability Analysis

The vulnerability is classified under [CWE-287] Improper Authentication and [CWE-1390] Weak Authentication. It exists in the CreateUserSession command handler within oVirt Engine. The handler accepts user creation requests but does not validate that the caller holds an authenticated session. As a result, any client capable of reaching the engine endpoint over the network can submit a request that provisions user accounts. The attack vector is network-based, requires no privileges, and needs no user interaction. Successful exploitation impacts integrity by allowing attackers to populate the identity store with attacker-controlled accounts. While the CVSS metrics do not record direct confidentiality or availability impact, attacker-created accounts may serve as a pivot for follow-on attacks against managed virtual machines, hypervisors, and storage domains. Remediation is delivered through the upstream patch tracked in oVirt pull request #914 and Red Hat advisory RHSA-2024:0934.

Root Cause

The root cause is missing authentication enforcement in the CreateUserSession command path. The command processes inbound requests without confirming that the requester presents a valid, authenticated session token. This logic gap allows the command to instantiate user objects on behalf of anonymous callers.

Attack Vector

An attacker reaches the oVirt Engine management interface over the network and issues a crafted request to the CreateUserSession command. Because the handler does not require prior authentication, the engine processes the request and creates the requested user record. The attacker can then leverage the newly created account or chain this primitive with other weaknesses to expand access.

No verified public exploit code is available at the time of writing. Refer to the Red Hat Bug Report and the oVirt patch for authoritative technical detail on the affected code path.

Detection Methods for CVE-2024-0822

Indicators of Compromise

Unexpected user accounts appearing in the oVirt Engine identity store without corresponding administrator audit entries.
Engine access logs showing CreateUserSession invocations originating from clients lacking a prior authentication event.
Authentication or session creation requests from unfamiliar source IP addresses to the oVirt management API.

Detection Strategies

Audit the oVirt Engine engine.log and audit log for CreateUserSession operations and correlate each invocation with an authenticated session ID.
Compare current user inventory against a known-good baseline to surface accounts created outside change management.
Inspect web server and reverse proxy logs in front of the engine for anonymous POST requests targeting session and user endpoints.

Monitoring Recommendations

Forward oVirt Engine audit and access logs to a centralized logging platform and alert on user creation events without a preceding authenticated login.
Monitor for spikes in session creation requests from a single source address that could indicate scripted abuse of the vulnerable command.
Track changes to the oVirt user directory and trigger review workflows on every new account.

How to Mitigate CVE-2024-0822

Immediate Actions Required

Apply the updates referenced in RHSA-2024:0934 to all oVirt Engine hosts.
Restrict network access to the oVirt Engine management interface to trusted administrative networks only.
Audit the user directory and disable or delete any accounts that cannot be tied to an authorized creation request.

Patch Information

Red Hat published advisory RHSA-2024:0934 containing updated ovirt-engine packages that enforce authentication in the CreateUserSession command. The upstream code change is tracked in oVirt pull request #914. Additional vendor context is available in the Red Hat CVE page.

Workarounds

Place the oVirt Engine behind a reverse proxy or firewall that requires mutual TLS or VPN access prior to reaching the management API.
Disable or block external access to the session creation endpoints until the patched packages are deployed.
Increase audit log retention and review frequency so that any unauthorized account creation is detected and reversed quickly.

bash

# Configuration example: update ovirt-engine on Red Hat-based systems
sudo dnf update ovirt-engine
sudo engine-setup
sudo systemctl restart ovirt-engine