Executive brief
OpenStack Glance, a service for managing virtual machine images, is vulnerable to a credential leak. When certain storage configurations are used, an authenticated user can retrieve the administrator's backend storage credentials (such as for Amazon S3 or Swift) simply by requesting a cached image. This could allow an attacker to gain unauthorized access to the underlying storage system where all virtual machine images are kept.
Technical details
An information exposure vulnerability exists in the OpenStack Glance v1 API when configured with single-tenant Swift or S3 storage backends. The vulnerability is rooted in the `_inject_location_header` function within the image serializer, which fails to strip sensitive backend location metadata when serving cached images. A remote authenticated attacker can trigger this by requesting a cached image, causing the server to return the `X-Image-Meta-Location` header containing plaintext credentials for the storage provider. This issue affects Glance versions Essex (2012.1), Folsom (2012.2), and Grizzly. Patches were released to ensure the location field is deleted from the image metadata before the response headers are populated.
Affected products
- OpenStack Glance Essex (2012.1), Folsom (2012.2), Grizzly
Timeline
- 2013-02-28: disclosed: Bug reported on Launchpad by Stuart McLaren
- 2013-03-22: advisory: NVD published CVE-2013-1840
- 2013-04-04: patched: Red Hat released security update RHSA-2013:0707