[OSSA 2013-031] Ceilometer log contains DB password in plain text (CVE-2013-6384)

[Eric Brown]

Both impl_db2.py and impl_mongodb.py log the password used to access the database by printing out the connection string from ceilometer.conf. The database connection configuration parameter is usually marked secret because it contains this password.

https://github.com/openstack/ceilometer/blob/master/ceilometer/storage/impl_db2.py#L156
https://github.com/openstack/ceilometer/blob/master/ceilometer/storage/impl_mongodb.py#L158

Typically, this ends up getting written to /var/log/ceilometer/api.log. This file is world read, thereby giving any user on the system access to the ceilometer user and password used to connect with the database and potentially more.

For example:
2013-10-22 15:33:41.244 10537 INFO ceilometer.storage.impl_db2 [-] connecting to MongoDB on mongodb://ceilometer:fe85b844214814b95a0b@127.0.0.1:27017/ceilometer

where "ceilometer" is the user and "fe85b844214814b95a0b" is the password.

I recommend removing this line or at least masking out the password part.
LOG.info('connecting to MongoDB on %s', url)

[Thierry Carrez (ttx)]

Given that this are non-DEBUG logs, I'd tend to publish an OSSA about this.

[Jeremy Stanley (fungi)]

Yes, I agree this meets the criteria for an advisory. We should issue an OSSA given that Ceilometer is no longer in incubation.

[Julien Danjou (jdanjou)]

https://review.openstack.org/#/c/56396/

[Thierry Carrez (ttx)]

Patch is public, cat out of bag etc

[Thierry Carrez (ttx)]

In master as of https://review.openstack.org/#/c/54553/

[Thierry Carrez (ttx)]

Proposed impact description, please check that it's accurately describing the issue:

---------------------
Title: Ceilometer DB2/MongoDB backend password leak
Reporter: Eric Brown (IBM)
Products: Ceilometer
Affects: All supported versions

Description:
Eric Brown from IBM reported an information leak in Ceilometer logs. The password for the DB2 or MongoDB backends was logged at INFO level in the ceilometer-api logs. An attacker with access to the logs (local shell, log aggregation system access, or accidental leak) may leverage this vulnerability to elevate privileges and gain direct full access to the Ceilometer backend. Only Ceilometer setups using the DB2 or MongoDB backends are affected.

[Jeremy Stanley (fungi)]

This impact description looks accurate to me.

In this case "all supported versions" only means Havana because Ceilometer did not graduate from incubation prior to the Grizzly release?

[Thierry Carrez (ttx)]

fungi: yes :)

[Thierry Carrez (ttx)]

CVE requested

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/56396
Committed: http://github.com/openstack/ceilometer/commit/ef6c659588feff646343fd80ba3d420d9c06404b
Submitter: Jenkins
Branch: stable/havana

commit ef6c659588feff646343fd80ba3d420d9c06404b
Author: Julien Danjou <email address hidden>
Date: Wed Oct 30 15:49:33 2013 +0100

    mongodb, db2: do not print full URL in logs

    The full URL used to connect to MongoDB or DB2 might contains sensitive
    information such as username and password, so it's better to not print
    it at all.
    Instead, just print the hosts that are being connected to.

    Fixes-Bug: #1244476

    (cherry picked from commit f2e651181f0016e96a123556aba46bd8d91e0012)

    Change-Id: I4390020d24386df38b1fae32aeeb657456142abd

[Thierry Carrez (ttx)]

[OSSA 2013-031]