Bug 1813788 (CVE-2020-1761)

Summary:	CVE-2020-1761 openshift/console: access token stored in browser local storage
Product:	[Other] Security Response	Reporter:	Jason Shepherd <jshepherd>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmontgom, eparis, jburrell, nstielau, rtillery, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openshift/console-4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1801831
Bug Blocks:	1813119

Description Jason Shepherd 2020-03-16 05:12:13 UTC

It was found that access token is stored in the browser’s local storage. Attackers can get the access token with physical access. In case of a XSS vulnerability, attackers can get the access token as javascript can read it.

Comment 4 Jason Shepherd 2020-03-16 23:23:21 UTC

Acknowledgments:

Name: Jeremy Choi (Red Hat)