Bug 1090120 – CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1090120 - (CVE-2014-0188) CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation

Summary:	CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation

Status:	CLOSED ERRATA

Aliases:	CVE-2014-0188

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=critical,public=20140423,repor...
Keywords:	Security

Depends On:	1090095 1090121 1090131
Blocks:	1090293
	Show dependency tree / graph

Reported:	2014-04-22 12:00 EDT by Kurt Seifried
Modified:	2015-07-15 21:23 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-04-23 15:26:56 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0422	normal	SHIPPED_LIVE	Critical: openshift-origin-broker security update	2014-04-23 06:29:09 EDT
Red Hat Product Errata	RHSA-2014:0423	normal	SHIPPED_LIVE	Critical: openshift-origin-broker security update	2014-04-23 06:39:23 EDT

Groups: None (edit)

Description Kurt Seifried 2014-04-22 12:00:16 EDT

Luke Meyer of Red Hat reports:

Description of problem:
The remote-user auth plugin provides an httpd config file intended to require 
authentication before setting the REMOTE_USER env var which is passed on to 
the plugin. However there are passthrough provisions for other forms of auth; 
in particular, the management console is allowed to set the X-Remote-User 
header on a request and have that transmuted to the REMOTE_USER env var (by 
virtue of being a non-proxied local request). When the REMOTE_USER env var is 
set, the remote-user plugin automatically trusts it. By combining the 
X-Remote-User header with one of the other passthrough triggers, any user can 
be impersonated without authenticating at all.

Additional info:
Simple workaround: add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User

Comment 3 errata-xmlrpc 2014-04-23 02:29:25 EDT

This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 1.2

Via RHSA-2014:0422 https://rhn.redhat.com/errata/RHSA-2014-0422.html

Comment 4 errata-xmlrpc 2014-04-23 02:39:34 EDT

This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 2.0

Via RHSA-2014:0423 https://rhn.redhat.com/errata/RHSA-2014-0423.html

Comment 6 Kurt Seifried 2015-07-15 21:23:45 EDT

Mitigation:

add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User

Note You need to log in before you can comment on or make changes to this bug.