OSSN-0037: Configure Horizon to mitigate BREACH/CRIME attacks¶

Summary¶

Horizon is vulnerable to BREACH/CRIME style chosen plaintext attacks in it’s default configuration.

Affected Services / Software¶

Horizon, Django, Apache, Nginx, SSL, TLS

Discussion¶

The BREACH attack may be used to compromise Django’s cross-site request forgery (CSRF) protection. OpenStack’s Horizon web dashboard is built on the Django framework, and is consequently affected. There is no fix available in Horizon itself, but there are protection options.

BREACH takes advantage of vulnerabilities when serving compressed data over SSL/TLS.

Recommended Actions¶

Since BREACH is related to serving compressed data, disabling compression of web responses can be used to mitigate these type of attacks. Some methods for this include:

Disable Django’s GZIP Middleware: https://docs.djangoproject.com/en/dev/ref/middleware/#module-django.middleware.gzip

Disable GZip compression in your web server’s config. For Apache httpd, you can do this by disabling mod_deflate: http://httpd.apache.org/docs/2.2/mod/mod_deflate.html

For Nginx, you can do this by disabling the gzip module: http://wiki.nginx.org/HttpGzipModule

Contacts / References¶

Author: Robert Clark, HP

This OSSN : https://docs.openstack.org/security-notes/OSSN-0037.html
Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1209250
OpenStack Security ML : openstack-security@lists.openstack.org
OpenStack Security Group : https://launchpad.net/~openstack-ossg
Django advice on BREACH : https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/
More info on BREACH : http://breachattack.com/

OSSN-0037: Configure Horizon to mitigate BREACH/CRIME attacks