CVE-2020-12691: 
Python vulnerability analysis and mitigation

A critical vulnerability (CVE-2020-12691) was discovered in OpenStack Keystone versions before 15.0.1 and version 16.0.0. The vulnerability was reported by a researcher named kay and disclosed on May 6, 2020. The issue affects the EC2 credentials API in OpenStack Keystone, which is the identity service component responsible for authentication and authorization (OpenStack OSSA).

The vulnerability stems from improper authorization controls in the EC2 credentials API. Any authenticated user could create an EC2 credential for themselves for a project they have a specified role on, and then perform an update to modify the credential's user and project attributes. The vulnerability has a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

This vulnerability allows a malicious user to masquerade as another user by modifying credential ownership. Most critically, it potentially allows the attacker to act as an admin on a project that another user has the admin role on, which can effectively grant the attacker global admin privileges. The impact is particularly severe because user IDs and project IDs are often not treated as sensitive information in OpenStack environments (OSS Security).

The vulnerability is exploitable by any authenticated user within the system. While initially thought to require guessing or knowledge of UUIDs (making it harder to exploit), it was later determined that in many OpenStack environments, user and project IDs are readily available or easily obtainable. For example, project admins can list users in their projects, and project IDs are often shared in chats or public repositories (Launchpad Bug).

The vulnerability was patched in OpenStack Keystone version 15.0.1. The fix ensures that when updating a credential, the new form of the credential is one the acting user has access to - system admins can change credentials to any user ID or project ID, but regular users may only modify credentials they own. Patches were released for multiple OpenStack branches including Rocky, Stein, Train, Ussuri, and Victoria (OpenStack OSSA).