OpenStack Keystone Role Escalation Vulnerability - CVE-2020-12690
Summary
CVE-2020-12690: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Affects keystone across 2 version ranges.
< 2:17.0.0~rc2-1
< 95b2bbeab113d9f04d1c81f7f1b48bf692bce979
Fixed in 2:17.0.0~rc2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an essential identity service for OpenStack, providing authentication and authorization for users and services. It manages user roles and permissions within projects, ensuring secure access control. However, prior to versions 15.0.1 and 16.0.0, Keystone had a critical vulnerability that allowed unintended role escalations due to improper handling of OAuth1 access tokens.
Vulnerability Detail
CVE-2020-12690 is a vulnerability in OpenStack Keystone that arises when the list of roles provided for an OAuth1 access token is ignored. This oversight means that when an access token is used to request a Keystone token, the resulting Keystone token includes all role assignments that the token creator had for the project. Consequently, this can lead to users having more permissions than intended, potentially allowing unauthorized access to sensitive resources and actions.
How To Fix
Minimum fixed version
2:17.0.0~rc2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of OAuth1 access tokens until the upgrade is applied. It is advisable to review and restrict role assignments for users to minimize the risk of unauthorized access.
Conclusion
CVE-2020-12690 is a significant vulnerability in OpenStack Keystone that can lead to unauthorized access due to improper handling of OAuth1 tokens. Users are strongly advised to upgrade to the fixed version to ensure the security of their systems. For those unable to upgrade immediately, implementing temporary workarounds can help mitigate risks.
See every vulnerability recorded for keystone →
FAQ
CVE-2020-12690 is a vulnerability in OpenStack Keystone that allows unintended role escalations due to improper handling of OAuth1 access tokens.
The vulnerability can lead to unauthorized access to resources, as users may receive more permissions than intended, compromising security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-12690 is 8.8, indicating a high severity level.
If an immediate upgrade is not possible, consider limiting the use of OAuth1 access tokens and reviewing user role assignments to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
