Bug 1090120 (CVE-2014-0188)

Summary: CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: bleanhar, ccoleman, dmcphers, jdetiber, jialiu, jkeck, jrusnack, kseifried, lmeyer, mbarrett, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-23 19:26:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1090095, 1090121, 1090131    
Bug Blocks: 1090293    

Description Kurt Seifried 2014-04-22 16:00:16 UTC
Luke Meyer of Red Hat reports:

Description of problem:
The remote-user auth plugin provides an httpd config file intended to require 
authentication before setting the REMOTE_USER env var which is passed on to 
the plugin. However there are passthrough provisions for other forms of auth; 
in particular, the management console is allowed to set the X-Remote-User 
header on a request and have that transmuted to the REMOTE_USER env var (by 
virtue of being a non-proxied local request). When the REMOTE_USER env var is 
set, the remote-user plugin automatically trusts it. By combining the 
X-Remote-User header with one of the other passthrough triggers, any user can 
be impersonated without authenticating at all.

Additional info:
Simple workaround: add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User

Comment 3 errata-xmlrpc 2014-04-23 06:29:25 UTC
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 1.2

Via RHSA-2014:0422 https://rhn.redhat.com/errata/RHSA-2014-0422.html

Comment 4 errata-xmlrpc 2014-04-23 06:39:34 UTC
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 2.0

Via RHSA-2014:0423 https://rhn.redhat.com/errata/RHSA-2014-0423.html

Comment 6 Kurt Seifried 2015-07-16 01:23:45 UTC
Mitigation:

add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User