A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack

func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {
    f.mu.Lock()
    defer f.mu.Unlock()
    result := []fs.FileInfo{}
    for _, im := range f.images {
        result = append(result, im)
    }
    return result, nil
}

func (f *imageFileSystem) Open(name string) (http.File, error) {
    f.log.Info("Open", "path", name)
    if name == "/" {
        return f, nil
    }
    ...

cmd/controller/main.go — file server bound on all interfaces without auth or TLS

http.Handle("/", http.FileServer(imageServer.FileSystem()))

go func() {
    server := &http.Server{
        Addr:              imagesBindAddr,   // default ":8084"
        ReadHeaderTimeout: 5 * time.Second,
    }
    err := server.ListenAndServe()

pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image

func (b *ignitionBuilder) authFile() ignition_config_types_32.File {
    source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret)
    return ignition_config_types_32.File{
        Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"},
        ...

Attack Pattern

Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.