Object GET on deleted account is successful

[Madhuri Kumari]

In case, we delete an account and then perform GET operation on object of the same account, the operation is successful which should actually fail.

Actually what happens here during object GET, the container is HEAD for its existence which in turn HEAD account(if info is not found in memcache), then account returns 404 which result in empty container_info. But in GETorHEAD method of ObjectController the container_info is not being checked. Thus the request is forwarded to object service and object service returns success.

[Jeremy Stanley (fungi)]

I've added an incomplete security advisory task and subscribed the Swift core security reviewers to confirm or refute the implied security impact of this bug.

Are you saying the Swift service continues to serve orphaned objects after deletion of the owning account? If so, it's not immediately obvious to me how this might be exploited by an attacker.

[Samuel Merritt (torgomatic)]

I think this could be classified as either an enhancement to Swift or a bug (I don't care which), but I don't think it's a security vulnerability. Typically, deleting an account is an action taken by an administrator; they'll also go tell the auth system that the user in question is no longer valid.

This bug (or whatever it is) doesn't let any user gain access to objects they shouldn't have; it just extends the period of time for which they have access.

[Thierry Carrez (ttx)]

I agree it hardly feels like a vulnerability.

[Madhuri Kumari (madhuri-rai07)]

Hi Jeremy, Samuel, Thierry,

If the issue is not a security vulnerability, the status can be changed.

Can I change the status?

And for the solution, I have thought of checking the existence in GETorHEAD of ObjectController which will return HTTPBadRequest if the account/container doesn't exists.

Please verify my understanding.

[Tristan Cacqueray (tristan-cacqueray)]

Thanks for the fix!

As "this bug doesn't let any user gain access to objects they shouldn't have" it is safe to change the status and fix this the usual way.

@Madhuri Feel free to submit your change to gerrit.

[Madhuri Kumari (madhuri-rai07)]

But still the information may be obsolete for about 60 seconds(i.e recheck_account_existence time period) because the information stored in memcache would serve the HEAD request to the account, thus serving the request successfully on objects.

So I have one query here to ask, is the above case fine or we can delete the entry in memcache after deletion of account in DELETE method of account.py?

Could you please suggest?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/145141

[OpenStack Infra (hudson-openstack)]

Change abandoned by John Dickinson (<email address hidden>) on branch: master
Review: https://review.openstack.org/145141
Reason: Abandoning due to lack of activity since the last negative review. You can restore the change if you want to keep working on it.

[clayg (clay-gerrard)]

I think we could make object GET 404 specifically if the container info discovers a 410 response - but it's a pretty low priority for an improvement.