Bug 2075681 (CVE-2022-1655)

Summary: CVE-2022-1655 OpenStack: Horizon session cookies are not flagged HttpOnly
Product: [Other] Security Response Reporter: amctagga
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: eglynn, jjoyce, lhh, mburns, rdopiera, rhos-maint, spower, steve.beattie
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: OpenStack 16.2 Doc Type: If docs needed, set a value
Doc Text:
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2083840    
Bug Blocks: 2075679    

Description amctagga 2022-04-14 21:25:38 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=2075518

Description of problem:

- An internal security audit discovered that Horizon session cookies are being created without the HttpOnly flag even though we set HorizonSecureCookies to true in our environment files.

- According to the KCS article at https://access.redhat.com/solutions/4764241 the relevant Django flag should be set manually in the dashboard configuration file.


Version-Release number of selected component (if applicable):

- Red Hat OpenStack 16.2.1 (Z1)


Actual results:

- From the Customer point of view, the workaround described in KCS 4764241 is unacceptable because those modifications would get lost every time the overcloud configuration is updated by TripleO and it would require a manual intervention on all controllers followed by a restart of the dashboard.


Expected results:

- The customer expectation is a fix (set of HttpOnly via Tripleo) of this problem in a next Z stream of OSP 16.2


Additional info:

- OpenStack recommendations on Cookies, related to the OpenStack O&M Dashboard (Horizon GUI), are available at: https://docs.openstack.org/security-guide/dashboard/cookies.html

- In term of common consequences, connected to the missing HttpOnly flag in the Cookies related to the O&M OpenStack Dashboard (Horizon GUI), these could identified in these two areas [1][2]

[1] Confidentiality impact:               
If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.

[2] Integrity impact:
If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., JWT and refresh token are written back to the browser in HTTP cookies. HttpOnly prevents JavaScript from accessing them, making them less vulnerable to theft. ) and assume the identity of the user.