[OSSA 2015-009] Sanitation of metadata label (CVE-2015-3988)

[Vlad Okhrimenko]

1) Start up Horizon
2) Go to Images
3) Next to an image, pick "Update Metadata"
4) From the dropdown button, select "Update Metadata"
5) In the Custom box, enter a value with some HTML like:
'<img>'
'<script><script>'
'</script><script>alert(1)</script>//'
and click +
6) On the right-hand side, give it a value, like "ee"
7) Click "Save"
8) Pick "Update Metadata" for the image again, the page will fail to load, and the JavaScript console says:

SyntaxError: invalid property id
var existing_metadata = {"

An alternative is if you change the URL to update_metadata for the image (for example, http://192.168.122.239/admin/images/fa62ba27-e731-4ab9-8487-f31bac355b4c/update_metadata/), it will actually display the alert box and a bunch of junk.

I'm not sure if update_metadata is actually a page, though... can't figure out how to get to it other than typing it in.

[Vlad Okhrimenko (vokhrimenko)]

upstream bug https://bugs.launchpad.net/horizon/+bug/1449260

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-6.1/2014.2
Change author: Thai Tran <email address hidden>
Review: https://review.fuel-infra.org/8473

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-7.0/2015.1.0
Change author: Thai Tran <email address hidden>
Review: https://review.fuel-infra.org/8475

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/8473
Submitter: mos-infra-ci <>
Branch: openstack-ci/fuel-6.1/2014.2

Commit: 60f9d110584fcf6b90608faaf6a01530568a70ea
Author: Thai Tran <email address hidden>
Date: Thu Jun 25 12:07:44 2015

Sanitation of metadata passed from Django

We need to escape HTML in metadata passed from Django, which
can lead to security issues. Refer to the bug for more details.

Co-Authored-By: Szymon Wroblewski <email address hidden>
Closes-bug: #1468744
cherry picked from commit e7f3e0880f4e311c768c413e43317674cb234515

Conflicts:
 horizon/templates/horizon/common/_modal_form_update_metadata.html

Change-Id: I9f749b689f9901db265b208ae917693a6f4a784f

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-6.0-updates/2014.2
Change author: Thai Tran <email address hidden>
Review: https://review.fuel-infra.org/8493

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: stable/6.1
Change author: Vadim Rovachev <email address hidden>
Review: https://review.fuel-infra.org/8925

[Vadim Rovachev (vrovachev)]

Bug reproduced after install patch https://review.fuel-infra.org/#/c/8493/

[Vitaly Sedelnik (vsedelnik)]

Changing the status to In Progress for 6.1.x, the review https://review.fuel-infra.org/8473 is merged however it still requires additional validation for 6.1.x (the last comment references review for 6.0-updates, not 6.1.x).

Vadim - please try to reproduce the issue in 6.1 with the fix from https://review.fuel-infra.org/8473 and change the status accordingly, thanks!

[Vadim Rovachev (vrovachev)]

This bug cannot be verified because we have another bug, which affects this bug.
Upstream bug: https://bugs.launchpad.net/glance/+bug/1471215
Fuel bug: https://bugs.launchpad.net/fuel/+bug/1472241

[Vitaly Sedelnik (vsedelnik)]

Removed from 6.1-mu-1 scope because the fix depends on https://bugs.launchpad.net/fuel/+bug/1472241 - to be included into 6.1-mu-2

[Denis Meltsaykin (dmeltsaykin)]

Our current deployment scheme uses haproxy as a frontend to every component. With the default configuration haproxy denies using "<>" in transmitted headers as it's considered as invalid. As changing glance API (may be other APIs too?) looks not like a good solution, I'd suggest to change haproxy's glance frontend configuration with `accept-invalid-http-response` option in order to pass headers unchanged. In my opinion, this would be good aligned with upstream's scheme which assumes that there is no any proxy or header-filtering in front of the glance API.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Alexey Shtokolov <email address hidden> on branch: stable/6.1
Review: https://review.fuel-infra.org/9086

[Fuel Devops McRobotson (fuel-devops-robot)]

Change restored by Alexey Shtokolov <email address hidden> on branch: stable/6.1
Review: https://review.fuel-infra.org/9086

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/9086
Submitter: Vitaly Sedelnik <email address hidden>
Branch: stable/6.1

Commit: 7218c80b9ac7e3c4a31374e491da02ad32fc1710
Author: Alex Ermolov <email address hidden>
Date: Fri Jul 10 12:09:56 2015

Sanitation of metadata label

Closes-Bug: #1468744
Change-Id: I4fa9f4db0887cd34b4579ff35eb51c5051c3eed9

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/8475
Submitter: mos-infra-ci <>
Branch: openstack-ci/fuel-7.0/2015.1.0

Commit: 9c959c2f8de5d0b4bd1d6996b6b4427865113c0d
Author: Thai Tran <email address hidden>
Date: Thu Jul 16 10:35:59 2015

Sanitation of metadata passed from Django

We need to escape HTML in metadata passed from Django, which
can lead to security issues. Refer to the bug for more details.

Co-Authored-By: Szymon Wroblewski <email address hidden>
Closes-bug: #1468744
cherry picked from commit e7f3e0880f4e311c768c413e43317674cb234515

Change-Id: I9625404f9b48d746ad76b4c806e5305db4264319

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: master
Change author: Vadim Rovachev <email address hidden>
Review: https://review.fuel-infra.org/9850

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Vadim Rovachev <email address hidden> on branch: master
Review: https://review.fuel-infra.org/9850

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/8493
Submitter: mos-infra-ci <>
Branch: openstack-ci/fuel-6.0-updates/2014.2

Commit: e5edda043fc30e02307bd4e849e9c8959cfe59ed
Author: Thai Tran <email address hidden>
Date: Thu Jun 25 17:03:28 2015

Sanitation of metadata passed from Django

We need to escape HTML in metadata passed from Django, which
can lead to security issues. Refer to the bug for more details.

Co-Authored-By: Szymon Wroblewski <email address hidden>
Closes-bug: #1468744
cherry picked from commit e7f3e0880f4e311c768c413e43317674cb234515

Conflicts:
 horizon/templates/horizon/common/_modal_form_update_metadata.html

Change-Id: I9f749b689f9901db265b208ae917693a6f4a784f
(cherry picked from commit 60f9d110584fcf6b90608faaf6a01530568a70ea)

[Vadim Rovachev (vrovachev)]

This fix does not work without change haproxy parameters.
In order to make this fix work you need to add parameter:
option accept-invalid-http-response
to /etc/haproxy/haproxy.cfg
and reset haproxy using pacemaker.

[Vadim Rovachev (vrovachev)]

verified for 6.0 with workaround for haproxy.

[Vadim Rovachev (vrovachev)]

verified for 6.1 with workaround for haproxy.

[oleksii shyman (oshyman)]

verified on ISO #246 for 7.0 with workaround for haproxy
how this haproxy will be solved in production?

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-8.0/liberty
Change author: Thai Tran <email address hidden>
Review: https://review.fuel-infra.org/13381

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Paul Karikh <email address hidden> on branch: openstack-ci/fuel-8.0/liberty
Review: https://review.fuel-infra.org/13381

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Vadim Rovachev <email address hidden> on branch: stable/6.1
Review: https://review.fuel-infra.org/8925