While doing some testing on Keystone using Syntribos (https://github.com/openstack/syntribos), our team (myself, Michael Dong, Rahul U Nair, Vinay Potluri, Aastha Dixit, and Khanak Nangia) noticed that we got 500 status codes when the string "..%c0%af" was inserted in various places in the URL for different types of requests.
HTTP/1.1 500 Internal Server Error
Date: Tue, 16 Aug 2016 22:05:36 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
X-Distribution: Ubuntu
x-openstack-request-id: req-57a41600-02b4-4d2a-b3e9-40f7724d65f2
Content-Length: 143
Connection: close
Content-Type: application/json
{"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}}
=========
GET /v3/domains/0426ac1e48f642ef9544c2251e07e261/groups/..%c0%af/roles HTTP/1.1
Host: [REDACTED]:5000
Connection: close
Accept-Encoding: gzip, deflate
Accept: application/json
User-Agent: python-requests/2.11.0
X-Auth-Token: [REDACTED]
HTTP/1.1 500 Internal Server Error
Date: Tue, 16 Aug 2016 22:07:09 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
X-Distribution: Ubuntu
x-openstack-request-id: req-02313f77-63c6-4aa8-a87e-e3d2a13ad6b7
Content-Length: 143
Connection: close
Content-Type: application/json
{"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}}
=========
I've marked this as a security issue as a precaution in case it turns out that there is a more serious vulnerability underlying these errors. We have no reason to suspect that there is a greater vulnerability at this time, but given the many endpoints this seems to affect, I figured caution was worthwhile since this may be a framework-wide issue. Feel free to make this public if it is determined not to be security-impacting.
Here is a (possibly incomplete) list of affected endpoints. Inserting the string "..%c0%af" in any or all of the spots labeled "HERE" should yield a 500 error. As you can see, virtually all v3 endpoints exhibit this behavior.
=========
[GET|PATCH|DELETE] /v3/endpoints/[HERE]
[GET|PATCH] /v3/domains/[HERE]
GET /v3/domains/[HERE]/groups/[HERE]/roles
[HEAD|PUT|DELETE] /v3/domains/[HERE]/groups/[HERE]/roles/[HERE]
GET /v3/domains/[HERE]/users/[HERE]/roles
[HEAD|DELETE] /v3/domains/[HERE]/users/[HERE]/roles/[HERE]
[GET|PATCH|DELETE] /v3/projects/[HERE]
[DELETE|PATCH] /v3/projects/[HERE]/cascade
GET /v3/projects/[HERE]/groups/[HERE]/roles
GET /v3/projects/[HERE]/users/[HERE]/roles
[HEAD|PUT|DELETE] /v3/projects/[HERE]/groups/[HERE]/roles/[HERE]
[GET|PATCH|DELETE] /v3/regions/[HERE]
[PATCH|DELETE] /v3/roles/[HERE]
[GET|PATCH|DELETE] /v3/services/[HERE]
[GET|PATCH|DELETE] /v3/users/[HERE]
GET /v3/users/[HERE]/groups
POST /v3/users/[HERE]/password
GET /v3/users/[HERE]/projects
GET /v3/OS-OAUTH1/users/[HERE]/access_tokens/[HERE]/roles/[HERE]
[GET|PATCH|DELETE] /v3/OS-OAUTH1/consumers/[HERE]
[GET|DELETE] /v3/OS-OAUTH1/users/[HERE]/access_tokens/[HERE]
While doing some testing on Keystone using Syntribos (https:/ /github. com/openstack/ syntribos), our team (myself, Michael Dong, Rahul U Nair, Vinay Potluri, Aastha Dixit, and Khanak Nangia) noticed that we got 500 status codes when the string "..%c0%af" was inserted in various places in the URL for different types of requests.
Here are some examples:
=========
DELETE /v3/policies/ ..%c0%af HTTP/1.1 requests/ 2.11.0
Host: [REDACTED]:5000
Connection: close
Accept-Encoding: gzip, deflate
Accept: application/json
User-Agent: python-
X-Auth-Token: [REDACTED]
Content-Length: 0
HTTP/1.1 500 Internal Server Error request- id: req-238fd5a9- be45-41f2- 893a-97b513b27a f3
Date: Tue, 16 Aug 2016 22:04:27 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
X-Distribution: Ubuntu
x-openstack-
Content-Length: 143
Connection: close
Content-Type: application/json
{"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}}
=========
PATCH /v3/policies/ ..%c0%af HTTP/1.1 requests/ 2.11.0
Host: [REDACTED]:5000
Connection: close
Accept-Encoding: gzip, deflate
Accept: application/json
User-Agent: python-
Content-type: application/json
X-Auth-Token: [REDACTED]
Content-Length: 70
{"type": "--serializatio n-mime- type--" , "blob": "--serialized- blob--" }
HTTP/1.1 500 Internal Server Error request- id: req-57a41600- 02b4-4d2a- b3e9-40f7724d65 f2
Date: Tue, 16 Aug 2016 22:05:36 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
X-Distribution: Ubuntu
x-openstack-
Content-Length: 143
Connection: close
Content-Type: application/json
{"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}}
=========
GET /v3/domains/ 0426ac1e48f642e f9544c2251e07e2 61/groups/ ..%c0%af/ roles HTTP/1.1 requests/ 2.11.0
Host: [REDACTED]:5000
Connection: close
Accept-Encoding: gzip, deflate
Accept: application/json
User-Agent: python-
X-Auth-Token: [REDACTED]
HTTP/1.1 500 Internal Server Error request- id: req-02313f77- 63c6-4aa8- a87e-e3d2a13ad6 b7
Date: Tue, 16 Aug 2016 22:07:09 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
X-Distribution: Ubuntu
x-openstack-
Content-Length: 143
Connection: close
Content-Type: application/json
{"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}}
=========
I've marked this as a security issue as a precaution in case it turns out that there is a more serious vulnerability underlying these errors. We have no reason to suspect that there is a greater vulnerability at this time, but given the many endpoints this seems to affect, I figured caution was worthwhile since this may be a framework-wide issue. Feel free to make this public if it is determined not to be security-impacting.
Here is a (possibly incomplete) list of affected endpoints. Inserting the string "..%c0%af" in any or all of the spots labeled "HERE" should yield a 500 error. As you can see, virtually all v3 endpoints exhibit this behavior.
=========
[GET|PATCH|DELETE] /v3/endpoints/ [HERE]
[GET|PATCH] /v3/domains/[HERE] [HERE]/ groups/ [HERE]/ roles [HERE]/ groups/ [HERE]/ roles/[ HERE] [HERE]/ users/[ HERE]/roles [HERE]/ users/[ HERE]/roles/ [HERE]
GET /v3/domains/
[HEAD|PUT|DELETE] /v3/domains/
GET /v3/domains/
[HEAD|DELETE] /v3/domains/
[GET|PATCH|DELETE] /v3/groups/[HERE] HERE]/users/ [HERE]
[HEAD|PUT|DELETE] /v3/groups[
[POST|DELETE] /v3/keys/[HERE]
[GET|PATCH|DELETE] /v3/policies/[HERE] [HERE]/ OS-ENDPOINT- POLICY/ endpoints/ [HERE] [HERE]/ OS-ENDPOINT- POLICY/ policy [HERE]/ OS-ENDPOINT- POLICY/ services/ [HERE] [HERE]/ OS-ENDPOINT- POLICY/ services/ [HERE] [HERE]/ OS-ENDPOINT- POLICY/ services/ regions/ [HERE]
[GET|PUT|DELETE] /v3/policies/
[GET|HEAD] /v3/policies/
[GET|PUT|DELETE] /v3/policies/
[PUT|DELETE] /v3/policies/
[GET|PUT|DELETE] /v3/policies/
[GET|PATCH|DELETE] /v3/projects/[HERE] [HERE]/ cascade [HERE]/ groups/ [HERE]/ roles [HERE]/ users/[ HERE]/roles [HERE]/ groups/ [HERE]/ roles/[ HERE]
[DELETE|PATCH] /v3/projects/
GET /v3/projects/
GET /v3/projects/
[HEAD|PUT|DELETE] /v3/projects/
[GET|PATCH|DELETE] /v3/regions/[HERE]
[PATCH|DELETE] /v3/roles/[HERE]
[GET|PATCH|DELETE] /v3/services/[HERE]
[GET|PATCH|DELETE] /v3/users/[HERE] [HERE]/ groups [HERE]/ password [HERE]/ projects
GET /v3/users/
POST /v3/users/
GET /v3/users/
GET /v3/OS- OAUTH1/ users/[ HERE]/access_ tokens/ [HERE]/ roles/[ HERE] OAUTH1/ consumers/ [HERE] OAUTH1/ users/[ HERE]/access_ tokens/ [HERE]
[GET|PATCH|DELETE] /v3/OS-
[GET|DELETE] /v3/OS-