CVE-2015-7546

OpenStack Keystone and keystonemiddleware token bypass

• CVSS 7.5
• CWE-522 Insufficiently Protected Credentials
• Authentication, Authorization, and Session Management
• Remote

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.

CVE

CVE-2015-7546

CWE

CWE-522 Insufficiently Protected Credentials

CVSS base score

7.5

Published

2016-02-03

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Keystone to version 2015.1.3 (Kilo) or 8.0.2 (Liberty) and keystonemiddleware to version 1.5.4 (Kilo) or 2.3.3 (Liberty).

from keystone import token

class TokenProvider(token.Provider):
    def validate_token(self, token_id, context=None):
        token_data = self.get_token_data(token_id)

        if token_data is None:
            raise Exception("Invalid token.")

        return token_data

    def get_token_data(self, token_id):
        pass

from keystone import exception
from keystone import token
from keystone import identity

class TokenProvider(token.Provider):
    def validate_token(self, token_id, context=None):
        token_data = self.get_token_data(token_id)

        if self.is_token_revoked(token_id):
            raise exception.Unauthorized("Token has been revoked.")

        return token_data

    def is_token_revoked(self, token_id):
        revoked_tokens = self.get_revoked_tokens()
        return token_id in revoked_tokens

    def revoke_token(self, token_id):
        self.add_to_revoked_tokens(token_id)

    def get_token_data(self, token_id):
        pass

    def get_revoked_tokens(self):
        return []

    def add_to_revoked_tokens(self, token_id):
        pass

@misc{vaitp:cve20157546,
  title        = {{OpenStack Keystone and keystonemiddleware token bypass}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-7546},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-7546/}}
}