CVE-2023-6110

OpenStack flaw allows deletion of unrelated access rules mistakenly.

• CVSS 5.5
• CWE-237
• Authorization, Authentication, and Session Management
• Remote

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.

CVE

CVE-2023-6110

CWE

CWE-237

CVSS base score

5.5

Published

2024-11-17

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authorization, Authentication, and Session Management

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

OpenStack

Solution

Upgrade to OpenStack version 2023.1 or later, where this issue is patched.

def delete_access_rule(rules, rule_id):
    del rules[rule_id]
    print(f"Access rule with ID {rule_id} has been deleted.")

access_rules = {
    'rule1': 'Application Credential 1',
    'rule2': 'Application Credential 2',
    'rule3': 'No Application Credential'
}

delete_access_rule(access_rules, 'non_existing_rule')

def delete_access_rule(rules, rule_id):
    if rule_id not in rules:
        print(f"Access rule with ID {rule_id} does not exist. No deletion performed.")
        return

    del rules[rule_id]
    print(f"Access rule with ID {rule_id} has been deleted.")

access_rules = {
    'rule1': 'Application Credential 1',
    'rule2': 'Application Credential 2',
    'rule3': 'No Application Credential'
}

delete_access_rule(access_rules, 'non_existing_rule')

{
    "rule_id": "non_existing_rule"
}

@misc{vaitp:cve20236110,
  title        = {{OpenStack flaw allows deletion of unrelated access rules mistakenly.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-6110},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-6110/}}
}