Executive brief
OpenStack Keystone is an identity and access management service that controls user permissions and role delegation across cloud infrastructure. A flaw in how Keystone handles delegated access tokens allows authenticated users to bypass intended permission limits by creating additional delegation chains, gaining higher privileges than originally granted. This could allow an attacker with limited access to escalate to administrative roles and compromise the entire cloud environment.
Technical details
This vulnerability is a privilege escalation in OpenStack Keystone's trust delegation mechanism (CWE-269: Improper Check of Insufficient Access Control). The root cause is that Keystone does not properly prevent the use of trust-scoped tokens to create additional trusts with expanded role sets. An authenticated remote user with impersonation-enabled delegation can obtain a trust-scoped token, then create a second trust with elevated roles not present in the original delegation, effectively bypassing the intended scope restrictions. This requires network access to Keystone and prior trust delegation with impersonation enabled. The fix prevents trust-scoped tokens from being used to create new trusts.
Affected products
- OpenStack Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2
Timeline
- 2014-05-29: disclosed
- 2014-06-17: advisory
- 2014-06-17: patched: Fixed in Keystone 2013.2.4, 2014.1.2, and Juno-2