CVE-2014-3473

What it actually does

Allows injection of arbitrary web script or HTML into the Orchestration/Stack section of the Horizon dashboard when a crafted Heat template is viewed, due to insufficient sanitization of template content provided by remote owners or catalogs.

Why it matters to the business

Attackers could execute scripts in administrators' browsers, leading to session hijacking, unauthorized actions within the dashboard, or data exposure in OpenStack environments that use the affected dashboard with Heat.

How an attack unfolds

An attacker supplies a malicious Heat orchestration template containing embedded script payloads to a catalog or directly as an owner; when a dashboard user views the template in the Orchestration/Stack interface, the browser executes the injected code with the user's privileges.

How to fix it

Upgrade OpenStack Horizon to version 2013.2.4 or later, 2014.1.2 or later, or Juno-2 or later; disable the Orchestration dashboard if Heat integration is not required; apply input sanitization filters on template rendering paths.

How to confirm the fix worked

Confirm deployed package versions meet or exceed the fixed releases; attempt to render a test template containing a benign script marker and verify it is not executed in the browser; review dashboard template preview code for proper escaping.

Typical attack path

1. Identify or gain access to an OpenStack Horizon deployment integrated with Heat
2. Create and upload a crafted orchestration template containing XSS payloads in the catalog or as an owned stack definition
3. Wait for or lure a privileged user to view the template details in the Orchestration dashboard
4. Execute browser-based actions such as cookie theft or form submission via the injected script

How to detect it

Review web server and application logs for unusual template rendering requests; inspect Heat template contents stored in the catalog for script tags or encoded payloads; check browser audit logs or proxy records for unexpected script execution originating from dashboard pages.

What your security team should do

• Prioritize upgrade of all Horizon instances to the fixed versions listed in remediation guidance
• Audit existing Heat templates for unexpected script content before allowing dashboard access
• Monitor for new template uploads from untrusted sources until patches are applied