Bug 2092304

Summary: openshift: Strict Transport Security Not Enforced
Product: [Other] Security Response Reporter: lnacshon
Component: weaknessAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asaket, bbennett, bmontgom, eparis, jburrell, jokerman, mfisher, mmasters, nstielau, ntait, sfowler, sponnaga
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2092305    
Bug Blocks: 2176332, 2203267    

Description lnacshon 2022-06-01 09:13:10 UTC
It was found in OpenShift Container Platform, that multiple default Routes did not have HTTP Strict Transport Security (HSTS) enabled. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks and weakens cookie-hijacking protections.

HSTS can be configured on individual Routes, however default cluster Routes in OpenShift are managed by their respective operators which may revert HSTS changes.

To enable HSTS on a route, add the haproxy.router.openshift.io/hsts_header value to the edge terminated or re-encrypt route within the yaml configuration:
apiVersion: v1
kind: Route
metadata:
  annotations:
    haproxy.router.openshift.io/hsts_header: max-age=31536000;includeSubDomains;preload


Affected URL(s):

https://oauth-openshift.apps.<cluster>.com/oauth/authorize
https://console-openshift-console.apps.<cluster>.com/

Comment 6 Sam Fowler 2023-03-08 00:23:01 UTC
Exploitation of this requires some kind of Man-In-The-Middle (MITM) attack[0], hence a rating of Moderate.

https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html#threats