Bug 1090120 (CVE-2014-0188) - CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation
Summary: CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0188
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1090095 1090121 1090131
Blocks: 1090293
TreeView+ depends on / blocked
 
Reported: 2014-04-22 16:00 UTC by Kurt Seifried
Modified: 2021-02-17 06:38 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-04-23 19:26:56 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0422 0 normal SHIPPED_LIVE Critical: openshift-origin-broker security update 2014-04-23 10:29:09 UTC
Red Hat Product Errata RHSA-2014:0423 0 normal SHIPPED_LIVE Critical: openshift-origin-broker security update 2014-04-23 10:39:23 UTC

Description Kurt Seifried 2014-04-22 16:00:16 UTC 
Luke Meyer of Red Hat reports:

Description of problem:
The remote-user auth plugin provides an httpd config file intended to require 
authentication before setting the REMOTE_USER env var which is passed on to 
the plugin. However there are passthrough provisions for other forms of auth; 
in particular, the management console is allowed to set the X-Remote-User 
header on a request and have that transmuted to the REMOTE_USER env var (by 
virtue of being a non-proxied local request). When the REMOTE_USER env var is 
set, the remote-user plugin automatically trusts it. By combining the 
X-Remote-User header with one of the other passthrough triggers, any user can 
be impersonated without authenticating at all.

Additional info:
Simple workaround: add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User
Comment 3 errata-xmlrpc 2014-04-23 06:29:25 UTC 
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 1.2

Via RHSA-2014:0422 https://rhn.redhat.com/errata/RHSA-2014-0422.html
Comment 4 errata-xmlrpc 2014-04-23 06:39:34 UTC 
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise 2.0

Via RHSA-2014:0423 https://rhn.redhat.com/errata/RHSA-2014-0423.html
Comment 6 Kurt Seifried 2015-07-16 01:23:45 UTC 
Mitigation:

add this in the host httpd conf global config, e.g. at the 
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:

RequestHeader unset X-Remote-User
Note You need to log in before you can comment on or make changes to this bug.