-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keystone | pip | < 26.0.1 | 26.0.1 |
| keystone | pip | = 27.0.0.0rc1 | 27.0.0 |
| keystone | pip | = 28.0.0.0rc1 | 28.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the /v3/ec2tokens and /v3/s3tokens API endpoints of OpenStack Keystone. These endpoints were intended to validate AWS credentials but lacked proper authorization checks. An attacker could use a valid AWS Signature, for instance from a publicly accessible pre-signed S3 URL, to make a request to these endpoints. Because the endpoints were unenforced, Keystone would process the request and grant Keystone authorization, leading to unauthorized access and privilege escalation. The security patches address this by removing the @ks_flask.unenforced_api decorator from the post methods of EC2TokensResource and S3TokensResource. This decorator was the root cause of the vulnerability as it explicitly disabled authentication and authorization. The fix introduces a policy enforcement check using ENFORCER.enforce_call, which restricts access to these endpoints to administrative or service accounts, thus preventing unauthenticated access.