Executive brief
OpenStack Nova's metadata service did not properly validate which tenant was making a request, allowing a remote attacker from one tenant to obtain sensitive metadata from another tenant's instances by spoofing the instance ID. This could expose configuration data, environment variables, and other instance-specific information that should be isolated between separate customers or organizational units in a multi-tenant cloud.
Technical details
The vulnerability is an authorization/authentication bypass (CWE-200: Exposure of Sensitive Information) in Nova's metadata handler and Neutron's metadata agent. The root cause is insufficient validation of the tenant ID associated with metadata requests: an attacker could update a port's device_id in Neutron to match another tenant's instance ID and then retrieve that instance's metadata without proper tenant boundary checks. The attack is network-reachable and requires no authentication beyond being a valid cloud tenant. The fix adds X-Tenant-ID validation in the metadata request handler to ensure the requesting tenant matches the instance owner in the database. Patches were released in Nova 12.0.0a0 and corresponding Neutron versions (Havana 2013.2.1 and later, Icehouse-1).
Affected products
- OpenStack Nova before 12.0.0a0
- OpenStack Neutron before Havana 2013.2.1 and Icehouse-1
Timeline
- 2013-12-11: disclosed: Published to oss-security mailing list
- 2013: patched: Patch commits merged for Nova and Neutron
- 2022-05-17: advisory: GitHub Security Advisory GHSA-22w9-j288-8p9w published