[OSSN-0088] Images v2 api metadef vulnerability

[Stuart McLaren]

It looks like a regular user can use the metadef api to create an unlimited number of records in the database.

 $ glance md-namespace-create ns1 xxx
 $ glance md-namespace-create ns2 xxx
 .
 .
 .

 $ glance md-tag-create --name tag OS::Software::WebServers
 $ glance md-tag-create --name tag2 OS::Software::WebServers
.
.
.

etc.

[Stuart McLaren (stuart-mclaren)]

Adding Travis.

@Travis

Any idea if there's something (eg quota/limit) which restricts the number of namespaces etc a user can create?

Thanks.

[Dan Smith (danms)]

I can confirm this locally in 2021 with a script to just create resources in a tight loop:

$ glance md-namespace-list | wc -l
2033
$ glance md-namespace-resource-type-list bar1 | wc -l
1004

(and still going)

I don't see any knobs to limit this, nor anywhere in the code that we attempt to cap the number of these objects we allow to be created. AFAICT, the policy for these are all open to regular users by default, which is not good.

I don't have permissions to set the importance of this bug, but despite the fact that this is five years old at this point, I'd rate this as non-trivial in terms of priority.

[Jeremy Stanley (fungi)]

This report came up in another discussion today, so for clarity I just wanted to state that the VMT is considering it a security hardening opportunity for now. If this is an avenue for filling up a reasonably provisioned database before an operator's typical database resource monitoring solution would alert them to the situation so they could disable the user's accounts, then we could reconsider issuing an advisory about it once fixed.

[Jeremy Stanley (fungi)]

Recommendations are now published here: https://wiki.openstack.org/wiki/OSSN/OSSN-0088