Executive brief
OpenStack Keystone is an identity management service that manages user credentials and authentication in cloud deployments. A flaw in versions 15.0.0 and 16.0.0 allows any user with a project role to view all credentials in the system—including other users' sign-on secrets like TOTP tokens—when scope enforcement is disabled. This can lead to unauthorized access to other users' cloud accounts and services.
Technical details
The vulnerability is an access control flaw (CWE-522) in the /v3/credentials API endpoint. When CONF.oslo_policy.enforce_scope is set to false, the list credentials function fails to properly filter credentials by project membership, allowing any authenticated user with a project role to enumerate all credentials regardless of ownership. The fix involves running the identity:get_credential policy check on each credential to filter results based on user permissions. The vulnerability affects Keystone 15.0.0 and 16.0.0, with patches released in versions 15.0.1 and 16.0.1. No user interaction is required—an authenticated attacker can exploit this via direct API calls.
Affected products
- OpenStack Keystone 15.0.0, 16.0.0
Timeline
- 2019-12-09: disclosed
- 2019-12-06: patched: Fix committed; patches released in versions 15.0.1 and 16.0.1