OSSN-0074: Nova metadata service should not be used for sensitive information

Summary

A recent security report has highlighted how users may be using the metadata service to store security sensitive information. The Nova metadata service should not be considered a secure repository of confidential information required by compute instances.

Affected Services / Software

Nova, All Versions

Discussion

A recent vulnerability report for Nova stated that the metadata service will obey the X-Forwarded-For HTTP header. This header is often supplied by proxies so that the end service can identify which IP the request originated from.

The Nova metadata service typically uses the source IP address of the incoming request to respond with the appropriate data for the compute instance making the request. This is a sort of weak authentication, designed to ensure that metadata for one tenant isn’t accidentally provided to another.

If the request contains a X-Forwarded-For HTTP header then the metadata service will use that for the source authentication rather than the actual TCP/IP source.

An attacker with access to a compute instance in the cloud could send a request to the metadata service and include the X-Forwarded-For header in order to effectively spoof their source and cause the metadata service to provide information that should not have been provided to that instance.

Consider the following: Alice creates a compute instance. She places the root password for that instance in the metadata service. The instance is assigned a 10.1.2.2 IP address. Alice believes that the root password for her instance is safe within the metadata service.

Alice retrieves metadata by running a command similar to:

curl http://169.254.169.254/latest/meta-data

This will retrieve any metadata stored for Alice’s compute instance, which has an IP address of 10.1.2.2.

Bob has a compute instance with IP address 10.1.9.9 however Bob wants access to the metadata for Alice’s compute instance. If Bob runs a similar command to Alice, but includes a custom header as below, he will get access to all of Alice’s metadata, including the root password she chose to store there:

curl -H "X-Forwarded-For: 10.1.2.2" http://169.254.169.254/latest/meta-data

The Nova metadata service is a useful utility within OpenStack but clearly not intended as a strongly authenticated system for storing sensitive data such as private keys or passwords.

Contacts / References

Author: Robert Clark, IBM