Bug 1902698 (CVE-2020-27816)

Summary:	CVE-2020-27816 openshift/elasticsearch-operator: arbitrary URL redirection of the cluster logging kibana console
Product:	[Other] Security Response	Reporter:	Przemyslaw Roguski <proguski>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aos-bugs, bmontgom, eparis, jburrell, jcantril, jokerman, nstielau, security-response-team, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	elasticsearch-operator-container 4.7	Doc Type:	---
Doc Text:	The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift cluster logging console link damage.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-08 14:41:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1898572, 1902768
Bug Blocks:	1899673

Description Przemyslaw Roguski 2020-11-30 12:56:47 UTC

In the OpenShift Container Platform  4.x the kibana logging console might be manipulated or even completely damaged by any user who create kibana resource in a non openshift-logging namespace. Due to that the console links is recreated by the elasticsearch-operator based on the new CR. If the new kibana resource is removed then the openshift-logging console link does not back to the original one but completely is lost.

This flaw could lead to an arbitrary URL redirection or the openshift-logging console link full damage.

Comment 3 Przemyslaw Roguski 2020-11-30 13:02:06 UTC

Fixes:
https://github.com/openshift/elasticsearch-operator/pull/581
https://github.com/openshift/elasticsearch-operator/pull/587

Comment 4 Przemyslaw Roguski 2020-12-01 11:08:21 UTC

Acknowledgments:

Name: Aivaras Laimikis

Comment 5 errata-xmlrpc 2021-02-08 13:41:39 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:0310 https://access.redhat.com/errata/RHSA-2021:0310

Comment 6 Product Security DevOps Team 2021-02-08 14:41:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27816