Bug 1330233 (CVE-2016-3703) - CVE-2016-3703 OpenShift Enterprise 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain
Summary: CVE-2016-3703 OpenShift Enterprise 3: Untrusted content loaded via the API pr...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-3703
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1329720 1331564
Blocks: 1330234 1335624
TreeView+ depends on / blocked
 
Reported: 2016-04-25 17:06 UTC by Kurt Seifried
Modified: 2021-02-17 03:59 UTC (History)
14 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2016-05-20 00:21:39 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1094 0 normal SHIPPED_LIVE Important: Red Hat OpenShift Enterprise 3.2 security update 2016-05-20 00:12:27 UTC
Red Hat Product Errata RHSA-2016:1095 0 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Enterprise 3.1 security update 2016-05-20 00:38:11 UTC

Description Kurt Seifried 2016-04-25 17:06:17 UTC 
Jordan Liggitt of Red Hat reports:

Malicious content can be loaded via the API proxy via a GET request if:
1. an authorized access_token is provided as a query parameter
2. anonymous access is granted to the service/proxy or pod/proxy API for the 
pod serving the content

That content has same-domain access to the browser localStorage if the web 
console and API server are hosted on the same domain. This gives the malicious 
content access to the logged in user's API credentials.
Comment 1 Kurt Seifried 2016-04-25 17:06:23 UTC 
Acknowledgments:

Name: Jordan Liggitt (Red Hat)
Comment 4 errata-xmlrpc 2016-05-19 20:13:13 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.2

Via RHSA-2016:1094 https://access.redhat.com/errata/RHSA-2016:1094
Comment 5 errata-xmlrpc 2016-05-19 20:38:20 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:1095 https://access.redhat.com/errata/RHSA-2016:1095
Note You need to log in before you can comment on or make changes to this bug.