Backport upstream security fix for login page DOS-attack vulnerability (CVE-2014-8124)

[Timur Sufiev]

Title: Horizon denial of service attack through login page
Reporter: Eric Peterson (Time Warner Cable)
Products: Horizon
Versions: up to 2014.1.3, and 2014.2 versions up to 2014.2.1

Description:
Eric Peterson from Time Warner Cable reported a vulnerability in
Horizon. By making repeated requests to the Horizon login page a remote
attacker may generate unwanted session records, potentially resulting in
a denial of service. Only Horizon setups using a db or memcached session
engine are affected.

[Mike Scherbakov (mihgen)]

Please provide ref to patch

[Timur Sufiev (tsufiev-x)]

Here you are: https://review.fuel-infra.org/#/c/1228/ The fix to django-openstack-auth is applied in the OBS, thus I cannot provide a ref to it.

[Timur Sufiev (tsufiev-x)]

Opening since it's opened in upstream: https://bugs.launchpad.net/horizon/+bug/1394370

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira9.git.867e12d.c9b0cb2

Changeset: https://review.fuel-infra.org/2115
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira9.git.867e12d.c9b0cb2.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira9.git.867e12d.c9b0cb2.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira9.git.867e12d.c9b0cb2.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira9.git.867e12d.c9b0cb2.noarch.rpm

NOTE: Changeset is not merged, created temporary package repository.
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable-2115/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira6+git.867e12d.c9b0cb2

Changeset: https://review.fuel-infra.org/2115
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira6+git.867e12d.c9b0cb2_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira6+git.867e12d.c9b0cb2_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira6+git.867e12d.c9b0cb2_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira6+git.867e12d.c9b0cb2_all.deb

NOTE: Changeset is not merged, created temporary package repository.
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable-2115/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira9.git.a828a43.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira9.git.a828a43.c9b0cb2.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira9.git.a828a43.c9b0cb2.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira9.git.a828a43.c9b0cb2.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira9.git.a828a43.c9b0cb2.noarch.rpm

NOTE: Changeset is not merged, created temporary package repository.
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable-2171/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira7+git.a828a43.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira7+git.a828a43.c9b0cb2_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira7+git.a828a43.c9b0cb2_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira7+git.a828a43.c9b0cb2_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira7+git.a828a43.c9b0cb2_all.deb

NOTE: Changeset is not merged, created temporary package repository.
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable-2171/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira9.git.a8b93e3.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira9.git.a8b93e3.c9b0cb2.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira9.git.a8b93e3.c9b0cb2.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira9.git.a8b93e3.c9b0cb2.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira9.git.a8b93e3.c9b0cb2.noarch.rpm

NOTE: Changeset is not merged, created temporary package repository.
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable-2171/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira7+git.a8b93e3.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira7+git.a8b93e3.c9b0cb2_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira7+git.a8b93e3.c9b0cb2_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira7+git.a8b93e3.c9b0cb2_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira7+git.a8b93e3.c9b0cb2_all.deb

NOTE: Changeset is not merged, created temporary package repository.
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable-2171/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira9.git.ec33d56.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira9.git.ec33d56.c9b0cb2.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira9.git.ec33d56.c9b0cb2.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira9.git.ec33d56.c9b0cb2.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira9.git.ec33d56.c9b0cb2.noarch.rpm

NOTE: Changeset is not merged, created temporary package repository.
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable-2171/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira7+git.ec33d56.c9b0cb2

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: patchset-created

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira7+git.ec33d56.c9b0cb2_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira7+git.ec33d56.c9b0cb2_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira7+git.ec33d56.c9b0cb2_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira7+git.ec33d56.c9b0cb2_all.deb

NOTE: Changeset is not merged, created temporary package repository.
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable-2171/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira9

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: change-merged

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira9.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira9.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira9.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira9.noarch.rpm

Changeset merged. Package placed on primary repository
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira7

Changeset: https://review.fuel-infra.org/2171
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Khivin
committer: Alex Khivin
subject: Horizon login page contains DOS attack mechanism
status: change-merged

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira7_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira7_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira7_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira7_all.deb

Changeset merged. Package placed on primary repository
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2.mira10

Changeset: https://review.fuel-infra.org/4800
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Ermolov
committer: Alex Ermolov
subject: Fix web-server memory overrun when downloading objects from Swift
status: change-merged

Files placed on repository:
openstack-dashboard-2014.1.3-fuel5.1.2.mira10.noarch.rpm
openstack-dashboard-theme-2014.1.3-fuel5.1.2.mira10.noarch.rpm
python-django-horizon-2014.1.3-fuel5.1.2.mira10.noarch.rpm
python-django-horizon-doc-2014.1.3-fuel5.1.2.mira10.noarch.rpm

Changeset merged. Package placed on primary repository
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-5.1.2-stable/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.1.3, package release == fuel5.1.2~mira8

Changeset: https://review.fuel-infra.org/4800
project: openstack/horizon
branch: openstack-ci/fuel-5.1.2/2014.1.1
author: Alex Ermolov
committer: Alex Ermolov
subject: Fix web-server memory overrun when downloading objects from Swift
status: change-merged

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.1.3-fuel5.1.2~mira8_all.deb
openstack-dashboard_2014.1.3-fuel5.1.2~mira8_all.deb
python-django-horizon_2014.1.3-fuel5.1.2~mira8_all.deb
python-django-openstack_2014.1.3-fuel5.1.2~mira8_all.deb

Changeset merged. Package placed on primary repository
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-5.1.2-stable/ubuntu

[OSCI Robot (oscirobot)]

RPM package horizon has been built for project openstack/horizon
Package version == 2014.2, package release == fuel6.0.mira10

Changeset: https://review.fuel-infra.org/5119
project: openstack/horizon
branch: openstack-ci/fuel-6.0-updates/2014.2
author: Alex Ermolov
committer: Alex Ermolov
subject: Fix web-server memory overrun when downloading objects from Swift
status: change-merged

Files placed on repository:
openstack-dashboard-2014.2-fuel6.0.mira10.noarch.rpm
python-django-horizon-2014.2-fuel6.0.mira10.noarch.rpm
python-django-horizon-doc-2014.2-fuel6.0.mira10.noarch.rpm

Changeset merged. Package placed on primary repository
RPM repository URL: http://osci-obs.vm.mirantis.net:82/centos-fuel-6.0-updates-stable/centos

[OSCI Robot (oscirobot)]

DEB package horizon has been built for project openstack/horizon
Package version == 2014.2, package release == fuel6.0~mira14

Changeset: https://review.fuel-infra.org/5119
project: openstack/horizon
branch: openstack-ci/fuel-6.0-updates/2014.2
author: Alex Ermolov
committer: Alex Ermolov
subject: Fix web-server memory overrun when downloading objects from Swift
status: change-merged

Files placed on repository:
openstack-dashboard-ubuntu-theme_2014.2-fuel6.0~mira14_all.deb
openstack-dashboard_2014.2-fuel6.0~mira14_all.deb
python-django-horizon_2014.2-fuel6.0~mira14_all.deb

Changeset merged. Package placed on primary repository
DEB repository URL: http://osci-obs.vm.mirantis.net:82/ubuntu-fuel-6.0-updates-stable/ubuntu

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-7.0/2015.1.0
Change author: Timur Sufiev <email address hidden>
Review: https://review.fuel-infra.org/8139

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-5.1.1-updates/2014.1.1
Change author: Alex Khivin <email address hidden>
Review: https://review.fuel-infra.org/9341

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Timur Sufiev <email address hidden> on branch: openstack-ci/fuel-7.0/2015.1.0
Review: https://review.fuel-infra.org/8139
Reason: Already there since stable/kilo merge.

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/9341
Submitter: mos-infra-ci <>
Branch: openstack-ci/fuel-5.1.1-updates/2014.1.1

Commit: 818be36550701873b3882ebf687593cac911aeff
Author: Alexey Khivin <email address hidden>
Date: Tue Jul 14 16:37:48 2015

Horizon login page contains DOS attack mechanism

the horizon login page (really the middleware) accesses the session
too early in the login process, which will create session records
in the session backend. This is especially problematic when non-cookie
backends are used.

After speaking with Eric Peterson in IRC private we agreed that line
`response.delete_cookie('logout_reason')` in
openstack_dashboard/views.py is not related to the sessions issue (and
was just a clean-up).

Change-Id: I0aeb98da8e9a21262f4a602a5ddae4a4315100e7
Closes-Bug: #1398893
Closes-Bug: #1399271
(cherry picked from commit ec33d56d4fd93cc8fda4b7ef4ae259de4806f5f3)

[Vadim Rovachev (vrovachev)]

steps to reproduce:
1. Stop apache

2. Change backend for session(/etc/openstack-dashboard/local_settings.py):
SESSION_ENGINE = 'django.contrib.sessions.backends.db'

DATABASES = {
    'default': {
        # Database configuration here
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'dash',
        'USER': 'dash',
        'PASSWORD': 'DASH_DBPASS',
        'HOST': 'localhost',
        'default-character-set': 'utf8'
    }
}

3. Run command:
/usr/share/openstack-dashboard/manage.py syncdb

4. Start apache

5. Connect to mysql and swith database to dash:
mysql dash

6. Look to records count in table:
select * from django_session;

7. Run attached script :
python <script.py>

6. Look to records count in table again:
select * from django_session;

If count is not changed that bug not reproduced.

[Vadim Rovachev (vrovachev)]

Sorry, colleagues. In previous comment step 3 and script is wrong.
Right step 3:
run commands:
mysql
CREATE DATABASE dash;
GRANT ALL PRIVILEGES ON dash.* TO 'dash'@'%' IDENTIFIED BY 'DASH_DBPASS';
GRANT ALL PRIVILEGES ON dash.* TO 'dash'@'localhost' IDENTIFIED BY 'DASH_DBPASS';
exit;
/usr/share/openstack-dashboard/manage.py syncdb

Right script attached.

[Vadim Rovachev (vrovachev)]

Verified on 5.1.1