PT-2017-17570 · Openstack · Openstack Glance

Luke Hinds · Published 2017-03-21 · Updated 2022-05-17 · CVE-2017-7200

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions prior to Newton

Description A Server-Side Request Forgery (SSRF) issue was discovered, allowing an attacker to perform masked network port scans through the 'copy from' feature in the Image Service API v1. This enables the creation of images with a URL such as 'http://localhost:22', which can then be used to enumerate internal network details while appearing masked, as the scan would seem to originate from the Glance Image service.

Recommendations For versions prior to Newton, consider disabling the 'copy from' feature in the Image Service API v1 as a temporary workaround to minimize the risk of exploitation. Restrict access to the Image Service API v1 to prevent potential attackers from creating malicious images.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-7200

GHSA-J6MR-CM6X-H6JG

Affected Products

Openstack Glance

References · 14

• https://osv.dev/vulnerability/GHSA-j6mr-cm6x-h6jg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7200 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-7200 · Security Note
• https://ubuntu.com/security/CVE-2017-7200 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7200 · Vendor Advisory
• https://wiki.openstack.org/wiki/OSSN/OSSN-0078 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7200 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7200 · Vendor Advisory
• https://github.com/openstack/glance · Note
• https://github.com/openstack/glance/commit/b1ac90f7914d91b25144cc4063fa994fb5019ee3 · Note
• http://securityfocus.com/bid/96988 · Note
• https://bugs.launchpad.net/ossn/+bug/1153614 · Note
• https://bugs.launchpad.net/ossn/+bug/1606495 · Note