Executive brief
OpenStack Nova is a cloud computing service that manages virtual machine instances in OpenStack deployments. The service was leaking console authentication tokens into readable log files, allowing attackers with log file access to obtain tokens needed for console access to virtual machines. This affects all Nova installations using novncproxy for remote console access.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in OpenStack Nova's console WebSocket proxy handler that logs unmasked consoleauth tokens. The vulnerable component is NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. An attacker with local or direct read access to Nova service logs can extract plaintext tokens used for console authentication and use them to gain unauthorized console access to virtual machines. The vulnerability affects Nova versions before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. Patches mask tokens in log output to prevent exposure.
Affected products
- OpenStack Nova before 18.2.4, 19.x before 19.1.0, 20.x before 20.1.0
Timeline
- 2020-02-19: disclosed
- 2020: patched: Fix released in Nova 18.2.4, 19.1.0, and 20.1.0
- 2022-05-24: advisory