Sorry for being so late to notice this review request. My bad, I made a
mistake earlier in the bug report mail by mi
sspelling my teammate's name. Can you please change 'edwardpeng' to
'Zhiniang Peng (@edwardzpeng) in OSSN-0093 and any other references'?

On Fri, 15 Mar 2024 at 01:49, Jeremy Stanley <email address hidden>
wrote:

> I've proposed a WIP update for OSSN-0093 with details about this bug now
> that it's public. Please review at your earliest opportunity as I'm
> hoping to update the canonical copy on the wiki and send it to mailing
> lists later today: https://review.opendev.org/c/openstack/security-
> doc/+/913239
> <https://review.opendev.org/c/openstack/security-doc/+/913239>
>
> ** Summary changed:
>
> - OpenStack Murano Component Information Leakage
> + Unsafe Environment Handling in MuranoPL
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/2048114
>
> Title:
>   Unsafe Environment Handling in MuranoPL
>
> Status in Murano:
>   New
> Status in OpenStack Security Advisory:
>   Won't Fix
> Status in OpenStack Security Notes:
>   Confirmed
> Status in YAQL:
>   Fix Released
>
> Bug description:
>   Members of the VMT received the following report by E-mail from
>   "kirualawliet l":
>
>   Title: OpenStack Murano Component Information Leakage
>
>   Reporter: lawliet and edwardpeng(@edwardzpeng) from Sangfor Security
>   Research Team
>
>   Products: OpenStack Murano Component
>
>   Affects: All versions of Murano Component
>
>   Description:
>
>   The Sangfor Security Research Team has identified a critical security
>   vulnerability in the Murano component of OpenStack. This vulnerability
>   allows ordinary users capable of importing and deploying app packages
>   to access sensitive information within OpenStack services.
>   Specifically, through this exploit, unauthorized users can obtain
>   Murano service account credentials, potentially escalating their
>   privileges to an administrator level. Subsequently, unauthorized users
>   can gain complete control over various resources, including user
>   roles, hosts, and networks.
>
>   The vulnerability stems from the Murano service's reliance on
>   MuranoPL, an extension of the YAQL language. The YAQL library includes
>   a 'format' function that mirrors Python's 'str.format' method,
>   enabling attribute access.
>
>   ```python
>   # code snippet from yaql-2.0.0\standard_library\strings.py:569
>   @specs.parameter('__format_string', yaqltypes.String())
>   @specs.extension_method
>   def format_(__format_string, *args, **kwargs):
>       ...
>       return __format_string.format(*args, **kwargs)
>   ```
>
>   An example of this vulnerability includes:
>
>   ```
>   >>> secret_key = "abcd1234"
>   >>> class Test:
>   ...     def __init__(self):
>   ...             pass
>   ...
>   >>> t = Test()
>   >>> # Exploiting the vulnerability to expose sensitive data:
>   >>> malicious_format_string =
> '{0.__class__.__init__.__globals__[secret_key]}'
>   >>> formatted_output = malicious_format_string.format(t)
>   >>> print(formatted_output)  # This line reveals the value of secret_key
>   'abcd1234'
>   ```
>
>   This exploit allows access to Murano service's oslo configuration
>   storage, thereby exposing critical Murano service account credentials,
>   granting unauthorized users administrative privileges.
>
>   We believe no deployment mode is immune to this vulnerability. To
>   ensure system security, we recommend immediate attention and
>   remediation of this vulnerability within the OpenStack Murano
>   component. Our team stands ready to offer assistance and collaboration
>   in addressing and resolving this issue promptly.
>
>   Thank you for your prompt attention to this matter.
>
>   Sincerely,
>   kirualawliet
>   Sangfor Security Research Team
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/murano/+bug/2048114/+subscriptions
>
>