The web server allows the HTTP TRACE or TRACK methods.

[Zhang Yun]

The Horizon affected by it. This is related to configuration of "RewriteCond" in sites-enabled/openstack-dashboard, covered by stackforge/cookbook-openstack-dashboard project.

[Tristan Cacqueray (tristan-cacqueray)]

The advisory task is incomplete pending additional details from security reviewers (horizon-coresec).

[Thierry Carrez (ttx)]

Hmm, this seems to be a Horizon packaging/deployment issue (if it is an issue at all). Since we don't cover stackforge/cookbook-openstack-dashboard from a security perspective, I don't see the need for an OSSA advisory here. Shouldn't this bug be reported against the cookbook maintainers instead ?

[Thierry Carrez (ttx)]

That would be an issue in the cookbook.

[Mark Vanderwiel (vanderwl)]

What is the bug here? Here's the RewriteCond logic: https://github.com/stackforge/cookbook-openstack-dashboard/blob/master/templates/default/dash-site.erb#L13

Please provide more information about what needs to be changed.

[Launchpad Janitor (janitor)]

[Expired for OpenStack + Chef because there has been no activity for 60 days.]

[Zhang Yun (zhangyun)]

Hi Mark, could we disable HTTP TRACE support in our web server to avoid this security issue?

[Mark Vanderwiel (vanderwl)]

yes, I believe we can easily disable this using the apache cookbook attribute default['apache']['traceenable'] = 'Off'

This can be done in your own environment file or we could add it to the repo env examples or we would consider changing it in the dashboard server recipe. Since it's quite specific to apache, my gut thinks this should not be part of the dashboard cookbook.
Opinions?

[Mark Vanderwiel (vanderwl)]

Or do we need to change the dashboard dash-site template from

 RewriteCond %{HTTPS} off

to

RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)

According to this post: http://www.techstacks.com/howto/disable-tracetrack-in-apache-httpd.html

[Zhang Yun (zhangyun)]

Hi Mark, seems like the #8 is a good solution, what is your opinion?

[Mark Vanderwiel (vanderwl)]

Yes, #8 seems like a good approach.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/130290

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/130290
Committed: https://git.openstack.org/cgit/stackforge/cookbook-openstack-dashboard/commit/?id=e3b14df8a2416734fb08f34cd10645c2a39dd364
Submitter: Jenkins
Branch: master

commit e3b14df8a2416734fb08f34cd10645c2a39dd364
Author: Mark Vanderwiel <email address hidden>
Date: Wed Oct 22 12:45:06 2014 -0500

    Allow TraceEnable to be configurable

    Change-Id: I4e6c486b9af8f72080c5d47310615f7f9fef744b
    Closes-Bug: #1319319

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/cookbook-openstack-dashboard ocata-eol release.