Summary
Canonical LXD contains an authorization flaw in the custom storage volume creation endpoint that can let an authenticated project user copy and read custom volumes belonging to other projects. The issue becomes risky when the requester can create custom volumes and submits a crafted source reference that omits the expected source type.
Affected context
The vulnerability occurs in Canonical LXD deployments on Linux where the custom storage volume creation API is available and project permissions allow an authenticated client to create custom volumes. In affected configurations, authorization checks may not correctly bind the requested source volume and source project to the caller's permitted project, potentially exposing the source volume, snapshots, and configuration.
Exploit preconditions
- Attack surface: LXD's custom storage volume creation endpoint
- Required access: An authenticated client with permission to create custom volumes in a project
- Trigger point: A volume-copy request containing a source volume and source project while omitting the expected source type
- Why exploitation is possible: Incomplete request validation can cause authorization logic to evaluate the source incorrectly or fail to enforce project isolation
Why this happens
The underlying bug is an authorization decision made without fully validating all security-relevant fields in a cross-project resource-copy request. When the source type is omitted, the endpoint may process a source volume from another project without applying the intended ownership or access checks. This maps to CWE-863, Incorrect Authorization, because a permitted operation is not consistently restricted to resources within the caller's authorized scope.
Potential impact
- An authenticated user may read custom storage volume contents from another project.
- Snapshots and volume configuration may be disclosed.
- Sensitive application, tenant, or infrastructure data could be exposed.
- Cross-project isolation may be weakened.
- An attacker could use exposed data to support further compromise or data manipulation.
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the resource and
project boundaries for every storage operation.
Common defensive patterns include:
- Require complete, explicit source descriptors before processing copy operations.
- Reject requests with missing, ambiguous, or inconsistent source-type fields.
- Re-check ownership and project access for both the source and destination resources.
- Apply deny-by-default authorization for cross-project volume operations.
- Minimize permissions granted to clients that can create or copy volumes.
- Use consistent policy enforcement across API handlers and backend storage drivers.
- Log and review cross-project access attempts and unusual volume-copy activity.
How teams detect issues like this
Organizations can look for:
- Static and semantic analysis of authorization checks involving project, tenant, and resource identifiers.
- Code review signals such as optional security-sensitive fields, implicit type inference, and authorization performed before request normalization.
- Negative tests that attempt cross-project reads with omitted, null, or conflicting source metadata.
- API policy checks ensuring that source and destination scopes are explicitly compared.
- Audit-log monitoring for authenticated clients copying volumes across project boundaries.
- Automated security review tools configured to identify missing object-level authorization and insecure direct object reference patterns.
