Privilege Escalation Vulnerability in Keystone: EC2 Credential Mismanagement
Summary
CVE-2020-12691: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Affects keystone across 2 version ranges.
< 2:17.0.0~rc2-1
< 95b2bbeab113d9f04d1c81f7f1b48bf692bce979
Fixed in 2:17.0.0~rc2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is the identity service used by OpenStack, providing authentication and authorization for users and services. It allows users to manage their identities and access resources in a cloud environment. The service is critical for maintaining security and access control within OpenStack deployments. However, a vulnerability exists that allows authenticated users to create and manipulate EC2 credentials, potentially leading to unauthorized access and privilege escalation.
Vulnerability Detail
An issue was discovered in OpenStack Keystone before versions 15.0.1 and 16.0.0, where any authenticated user can create an EC2 credential for themselves for a project where they have a specified role. This credential can then be updated to change the user and project associated with it, allowing the malicious user to impersonate another user, including those with admin privileges. This could effectively grant the malicious user global admin rights on the project, posing a significant security risk.
How To Fix
Minimum fixed version
2:17.0.0~rc2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ability of users to create EC2 credentials by modifying the role permissions in your OpenStack configuration. Ensure that only trusted users have roles that allow them to create or manage EC2 credentials.
Conclusion
CVE-2020-12691 presents a significant security risk in OpenStack Keystone, allowing unauthorized privilege escalation through EC2 credential manipulation. It is crucial to upgrade to the fixed version to mitigate this vulnerability and ensure the security of your OpenStack deployment.
See every vulnerability recorded for keystone →
FAQ
CVE-2020-12691 is a vulnerability in OpenStack Keystone that allows authenticated users to create and manipulate EC2 credentials, potentially leading to privilege escalation.
The vulnerability can allow a malicious user to impersonate another user, including those with admin privileges, granting them unauthorized access to sensitive resources.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing role-based access controls to limit the ability of users to create EC2 credentials as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
