CVE-2014-3476
openstack-keystone: privilege escalation through trust chained delegation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
OpenStack Identity (Keystone) anterior a 2013.2.4, 2014.1 anterior a 2014.1.2, y Juno anterior a Juno-2 no maneja debidamente la delegación encadenada, lo que permite a usuarios remotos autenticados ganar privilegios mediante el aprovechamiento de un token (1) trust o (2) OAuth con suplantación habilitada para crear un token nuevo con roles adicionales.
A flaw was found in keystone's chained delegation. A trustee able to create a delegation from a trust or an OAuth token could misuse identity impersonation to bypass the enforced scope, possibly allowing them to obtain elevated privileges to the trustor's projects and roles.
The OpenStack Identity service authenticates and authorizes OpenStack users by keeping track of users and their permitted activities. The Identity service supports multiple forms of authentication, including user name and password credentials, token-based systems, and AWS-style logins. A flaw was found in keystone's chained delegation. A trustee able to create a delegation from a trust or an OAuth token could misuse identity impersonation to bypass the enforced scope, possibly allowing them to obtain elevated privileges to the trustor's projects and roles.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-05-14 CVE Reserved
- 2014-06-17 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/57886 | Third Party Advisory | |
| http://secunia.com/advisories/59547 | Third Party Advisory | |
| http://www.securityfocus.com/bid/68026 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://bugs.launchpad.net/keystone/+bug/1324592 | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2014/06/12/3 | 2020-06-02 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00031.html | 2020-06-02 | |
| https://access.redhat.com/security/cve/CVE-2014-3476 | 2014-07-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1104524 | 2014-07-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openstack Search vendor "Openstack" | Keystone Search vendor "Openstack" for product "Keystone" | >= 2013.2 < 2013.2.4 Search vendor "Openstack" for product "Keystone" and version " >= 2013.2 < 2013.2.4" | - |
Affected
| ||||||
| Openstack Search vendor "Openstack" | Keystone Search vendor "Openstack" for product "Keystone" | >= 2014.1 < 2014.1.2 Search vendor "Openstack" for product "Keystone" and version " >= 2014.1 < 2014.1.2" | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Cloud Search vendor "Suse" for product "Cloud" | 3 Search vendor "Suse" for product "Cloud" and version "3" | - |
Affected
| ||||||