OSSN-0053: Keystone token disclosure may result in malicious trust creation

Summary

Keystone tokens are the foundation of authentication and authorization in OpenStack. When a service node is compromised, it is possible that an attacker would have access to all tokens passing through that node. With a valid token an attacker will be able to issue new tokens that may be used to create trusts between the originating user and a new user.

Affected Services / Software

Keystone, Grizzly, Havana, Icehouse, Juno, Kilo

Discussion

If a service node is compromised, an attacker now has access to every token that passes through that node. By default, a Keystone token can be exchanged for another token, and there is no restriction on scoping of the new token. With the trust API, these tokens can be used to delegate roles between the original user and a new user.

Trusts allow a user to set up a long term delegation that permits another user to perform operations on their behalf. While tokens created through trusts are limited in what they can do, the limitations are only on things like changing passwords or creating new tokens. This would grant an attacker access to all the operations available to the originating user in their projects, and the roles that are delegated through the trust.

There are other ways that a compromised token can be misused beyond the methods described here. This note addresses one possible path for vulnerabilities based on the unintended access that could be gained from trusts created through intercepted tokens.

This behavior is intrinsic to the bearer token model used within Keystone / OpenStack.

Contacts / References

Author: Michael McCune, Red Hat