Bug 2061324
| Summary: | security group called 'new' causes server error | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Pierre Prinetti <pprinett> |
| Component: | openstack-neutron | Assignee: | Miro Tomaska <mtomaska> |
| Status: | CLOSED WONTFIX | QA Contact: | Eran Kuris <ekuris> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 17.1 (Wallaby) | CC: | chrisw, mlavalle, mtomaska, scohen |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | Flags: | ifrangs:
needinfo?
(mtomaska) |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-07-25 20:44:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Pierre Prinetti
2022-03-07 12:12:34 UTC
This happens on TripleO standalone, but I have reproduced on a public cloud. On my standalone, here are the corresponding Neutron server logs: ``` 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource [req-04484587-cff0-45e5-8b7d-da6b7cf7d911 1a06fd8e47a34b3f812cbbe936f38d09 d5c2aa2a5049492589e9a322bcd9d172 - default default] new failed: No details.: AttributeError 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource Traceback (most recent call last): 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource File "/usr/lib/python3.6/site-packages/neutron/api/v2/resource.py", line 97, in resource 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource method = getattr(controller, action) 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource File "/usr/lib/python3.6/site-packages/neutron/api/v2/base.py", line 263, in __getattr__ 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource raise AttributeError() 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource AttributeError 2022-03-07 12:27:50.594 20 ERROR neutron.api.v2.resource 2022-03-07 12:27:50.595 20 INFO neutron.wsgi [req-04484587-cff0-45e5-8b7d-da6b7cf7d911 1a06fd8e47a34b3f812cbbe936f38d09 d5c2aa2a5049492589e9a322bcd9d172 - default default] 10.254.1.1 "GET /v2.0/security-groups/new HTTP/1.1" status: 500 len: 344 time: 0.3884084 ``` Marked as security-sensitive until someone more expert than me excludes this to be a remote code execution channel. On a default RHSOP install who (Admin/User/Anybody) can create security groups? Could this setting further be restricted by policy? There's something specific to the name "new" which is triggering the issue? Presumably it is being interpreted wrong. It does not have to do with being 3 characters long or some other condition? Is the group of users who can query the security groups the same as who can create security groups? Are there other operations which can trigger it (show all security groups or rename to/from "new")? When the 500 error happens is there any other impact to Neutron than the attribute error? If a malicious individual ran that command repeatedly forever, would any services be degraded or fail completely? Would it be detrimental to the logs (using up storage space or a loud/spammy method to hide something more malicious they accomplished)? Of all these good questions, there is only one I can answer: not all three-letter names trigger the issue. Also, I have not fund any other name triggering the issue so far. For the record, I could use these strings as security group names without issue: "old" "init" "append" "raise" "proxy" "in" "True". While this flaw does have a security impact, it seems quite minimal. I don't see reason enough to keep this bug private. (In reply to Nick Tait from comment #5) > While this flaw does have a security impact, it seems quite minimal. I don't > see reason enough to keep this bug private. OK! However I don't think anybody but you can make this report public. Or can I? Sounds good, making it public now. It appears that wsgiorg routing args[1] are not parsed properly where the name "new" becomes the action[2]. For example,
(Pdb) pp route_args
(<routes.util.URLGenerator object at 0x7f9358b86ac0>,
{'action': 'new',
'controller': <wsgify at 140270746228240 wrapping <function Resource.<locals>.resource at 0x7f93589020d0>>})
where in a situation where the security group name is "sg1" the route_args look like this
(Pdb) pp route_args
(<routes.util.URLGenerator object at 0x7f9358b8d5b0>,
{'action': 'show',
'controller': <wsgify at 140270746228240 wrapping <function Resource.<locals>.resource at 0x7f93589020d0>>,
'id': 'sg1'})
Side note, `openstack router show new` has the same problem.
[1] https://github.com/openstack/neutron/blob/master/neutron/api/v2/resource.py#L55
[2] https://github.com/openstack/neutron/blob/master/neutron/api/v2/resource.py#L65
|