VPN shared PSK shown in plaintext

[Steve McLellan]

In the neutron VPN details and form, https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/vpn/templates/vpn/_ipsecsiteconnection_details.html#L43 and https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/vpn/forms.py#L249 don't offer the option of hiding the string. Typically sensitive information like passwords is hidden by default, requiring the user to explicitly choose to make it visible by clicking an icon (like the eye icon).

Filing this as a security bug out of an overabundance of caution; while it is related to security it doesn't describe a vulnerability that can be exploited by means other than shoulder surfing.

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Tristan Cacqueray (tristan-cacqueray)]

@horizon-coresec please triage this bug report.

Perhaps this doesn't need to be kept private and can be fixed in the open ?

[David Lyle (david-lyle)]

I think this can be fixed in the open. The risk is someone viewing over your shoulder as you enter the key, much as not obscuring a password when typing it. It's not ideal, but the risk is quite limited.

[Steve McLellan (sjmc7)]

I'm fine with that; Rob had suggested filing as security just to be safe but I agree shoulder surfing isn't the same as a remote vulnerability.

[Jeremy Stanley (fungi)]

Agreed, this doesn't seem like it needs to be handled under embargo, and could be worked further in public instead.

[Tristan Cacqueray (tristan-cacqueray)]

Moreover this doesn't really deserve an advisory, it sounds like a class D type of bug (hardening) according to: https://security.openstack.org/vmt-process.html#incident-report-taxonomy

[Grant Murphy (gmurphy)]

I agree. I don't think we need an advisory for this.

[Tristan Cacqueray (tristan-cacqueray)]

Based on above comment, I removed the OSSA task.

[Rob Cresswell (robcresswell-deactivatedaccount)]

Submitting patches automatically updates Launchpad. Please don't modify the status to In Progress manually.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/434508

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/434508
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=5137dc4fdd19de3494293731abffdfb7e5b26449
Submitter: Jenkins
Branch: master

commit 5137dc4fdd19de3494293731abffdfb7e5b26449
Author: Julie Gravel <email address hidden>
Date: Wed Feb 15 12:08:12 2017 -0800

    Make VPN IPSec Site Connection PSK field hidden

    The Pre-Shared Key (PSK) field on the VPN IPSec Site Connection tab
    should not be displayed in plain text due to security concerns. Set
    the PSK field in the Add Connection and the Edit Connection dialogs
    to be a password field to provide the user some protection when
    entering the value. Remove the PSK field from the details page since
    this is the pattern used with the password field in Identity Users
    panel.

    Change-Id: I4dd713f01b02c29d9822efcb519de60fd9d035e6
    Close-Bug: #1575909

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/440733

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/440734

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/440736

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/440736
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=7a1a8b373935904ce0701f3c3758ec1f56c243ea
Submitter: Jenkins
Branch: stable/mitaka

commit 7a1a8b373935904ce0701f3c3758ec1f56c243ea
Author: Julie Gravel <email address hidden>
Date: Wed Feb 15 12:08:12 2017 -0800

    Make VPN IPSec Site Connection PSK field hidden

    The Pre-Shared Key (PSK) field on the VPN IPSec Site Connection tab
    should not be displayed in plain text due to security concerns. Set
    the PSK field in the Add Connection and the Edit Connection dialogs
    to be a password field to provide the user some protection when
    entering the value. Remove the PSK field from the details page since
    this is the pattern used with the password field in Identity Users
    panel.

    Change-Id: I4dd713f01b02c29d9822efcb519de60fd9d035e6
    Close-Bug: #1575909
    (cherry picked from commit 5137dc4fdd19de3494293731abffdfb7e5b26449)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/440734
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=cb65d6b873482c518d602bc7e359dce1c5312454
Submitter: Jenkins
Branch: stable/newton

commit cb65d6b873482c518d602bc7e359dce1c5312454
Author: Julie Gravel <email address hidden>
Date: Wed Feb 15 12:08:12 2017 -0800

    Make VPN IPSec Site Connection PSK field hidden

    The Pre-Shared Key (PSK) field on the VPN IPSec Site Connection tab
    should not be displayed in plain text due to security concerns. Set
    the PSK field in the Add Connection and the Edit Connection dialogs
    to be a password field to provide the user some protection when
    entering the value. Remove the PSK field from the details page since
    this is the pattern used with the password field in Identity Users
    panel.

    Change-Id: I4dd713f01b02c29d9822efcb519de60fd9d035e6
    Close-Bug: #1575909
    (cherry picked from commit 5137dc4fdd19de3494293731abffdfb7e5b26449)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/440733
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=03f78705e8e4756537b2da4bbada8101f9f16f3a
Submitter: Jenkins
Branch: stable/ocata

commit 03f78705e8e4756537b2da4bbada8101f9f16f3a
Author: Julie Gravel <email address hidden>
Date: Wed Feb 15 12:08:12 2017 -0800

    Make VPN IPSec Site Connection PSK field hidden

    The Pre-Shared Key (PSK) field on the VPN IPSec Site Connection tab
    should not be displayed in plain text due to security concerns. Set
    the PSK field in the Add Connection and the Edit Connection dialogs
    to be a password field to provide the user some protection when
    entering the value. Remove the PSK field from the details page since
    this is the pattern used with the password field in Identity Users
    panel.

    Change-Id: I4dd713f01b02c29d9822efcb519de60fd9d035e6
    Close-Bug: #1575909
    (cherry picked from commit 5137dc4fdd19de3494293731abffdfb7e5b26449)