CVE-2014-3801

What it actually does

The vulnerability permits remote authenticated users to retrieve provider template URLs through the resource-type-list API endpoint when stacks are created from templates that reference provider templates.

Why it matters to the business

Exposure of internal template locations can reveal infrastructure configuration details to insiders or compromised accounts, potentially aiding reconnaissance for subsequent attacks in OpenStack deployments.

How an attack unfolds

An authenticated attacker interacts with the Heat API to create or reference a stack that uses a provider template and then queries the resource-type-list endpoint, which inadvertently returns the provider template URL in the response.

How to fix it

Upgrade OpenStack Heat to a version beyond 2013.2.3 or 2014.1 that enforces proper access controls on provider template metadata in resource-type-list responses.

How to confirm the fix worked

Test the resource-type-list API response for stacks using provider templates to confirm provider URLs are no longer disclosed to users without explicit authorization.

Typical attack path

1. Obtain valid OpenStack credentials with Heat API access
2. Authenticate to the Orchestration service
3. Initiate stack creation using a template that references a provider template
4. Issue a resource-type-list request to extract the leaked provider template URL

How to detect it

Inspect Heat API access logs for resource-type-list operations tied to provider template usage around the time of stack creation events.

What your security team should do

• Audit Heat API access permissions to limit exposure
• Review historical logs for resource-type-list queries on affected versions
• Prioritize upgrade of Heat components in all OpenStack environments