48 lines
2.0 KiB
Plaintext
48 lines
2.0 KiB
Plaintext
Sample Keystone v3 policy exposes privilege escalation vulnerability
|
|
---
|
|
|
|
### Summary ###
|
|
The policy.v3cloudsample.json sample Keystone policy file combined with
|
|
the underlying mutability of the domain ID for user, group, and project
|
|
entities exposed a privilege escalation vulnerability. When this
|
|
sample policy is applied a domain administrator can elevate their
|
|
privileges to become a cloud administrator.
|
|
|
|
### Affected Services / Software ###
|
|
Keystone, Havana
|
|
|
|
### Discussion ###
|
|
Changes to the Keystone v3 sample policy during the Havana release cycle
|
|
set an excessively broad domain administrator scope that allowed
|
|
creation of roles ("create_grant") on other domains (among other
|
|
actions). There was no check that the domain administrator had
|
|
authority to the domain they were attempting to grant a role on.
|
|
|
|
Combining the mutable state of the domain ID for user, group, and
|
|
project entities with the sample v3 policy resulted in a privilege
|
|
escalation vulnerability. A domain administrator could execute a series
|
|
of steps to escalate their access to that of a cloud administrator.
|
|
|
|
### Recommended Actions ###
|
|
Review the following updated sample v3 policy file from the OpenStack
|
|
Icehouse release:
|
|
|
|
https://git.openstack.org/cgit/openstack/keystone/commit/?id=0496466821c1ff6e7d4209233b6c671f88aadc50
|
|
|
|
You should ensure that your Keystone deployment appropriately reflects
|
|
that update. Domain administrators should generally only be permitted
|
|
to perform actions against the domain for which they are an
|
|
administrator.
|
|
|
|
Optionally, review the recent addition of support for immutable domain
|
|
IDs and consider it for applicability to your Keystone deployment:
|
|
|
|
https://git.openstack.org/cgit/openstack/keystone/commit/?id=a2fa6a6f01a4884edf369cafa39946636af5cf1a
|
|
|
|
### Contacts / References ###
|
|
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0010
|
|
Original LaunchPad Bug : https://bugs.launchpad.net/keystone/+bug/1287219
|
|
OpenStack Security ML : openstack-security@lists.openstack.org
|
|
OpenStack Security Group : https://launchpad.net/~openstack-ossg
|
|
|