Cloudanix VulnDB

CVE-2015-5251

None

CVSS

—

EPSS

2.1%

Published

Oct 26, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in an older version of OpenStack's image service let users with login access secretly change the status of images they should not control.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote authenticated users can bypass image access restrictions by supplying the x-image-meta-status HTTP header in requests to images/* endpoints, allowing unauthorized changes to image status metadata.

Why it matters to the business

Attackers with valid credentials can alter visibility or state of shared cloud images, potentially exposing sensitive virtual machine templates or disrupting image management workflows in OpenStack deployments.

How an attack unfolds

An authenticated user crafts an image update request that includes a forged x-image-meta-status header; the vulnerable Glance service accepts the header without proper authorization checks and applies the status change, bypassing intended access controls.

How to fix it

Upgrade OpenStack Glance to 2014.2.4 (Juno) or 2015.1.2 (Kilo) or later releases that enforce proper authorization on the x-image-meta-status header.

How to confirm the fix worked

Confirm deployed Glance version is at or above the fixed releases; attempt an image status change using the x-image-meta-status header from a non-admin account and verify the request is rejected.

Typical attack path

  1. Obtain valid OpenStack credentials with image service access
  2. Identify an image whose status should be altered
  3. Issue a PATCH or PUT request to the images endpoint while injecting the x-image-meta-status header
  4. Observe the status change take effect without corresponding permission checks
  5. Leverage the modified image status for further actions such as unauthorized sharing or deletion

How to detect it

Inspect Glance API logs for requests containing the x-image-meta-status header originating from non-admin accounts; correlate with image status change events that lack corresponding policy authorization entries.

  • x-image-meta-status
  • images/.* HTTP header manipulation
  • status changed via PATCH without admin role

What your security team should do

  • Immediately upgrade all Glance deployments to the fixed versions listed in the advisory
  • Review image access policies and restrict image creation or modification to trusted roles where possible
  • Enable detailed API logging for the image service to monitor for anomalous header usage

The record

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Affected packages

Ecosystem Package Introduced Fixed
PyPI glance 0 2014.2.4
PyPI glance 2011.2 2014.2.4
PyPI glance 2015.1.0 2015.1.2
Debian:11 glance 0 1:11.0.0-1
Debian:12 glance 0 1:11.0.0-1
Debian:13 glance 0 1:11.0.0-1
Red Hat:openstack:5::el6 openstack-glance 0 0:2014.1.5-3.el6ost
Red Hat:openstack:5::el6 openstack-glance-doc 0 0:2014.1.5-3.el6ost
Red Hat:openstack:5::el6 python-glance 0 0:2014.1.5-3.el6ost
Red Hat:openstack:5::el7 openstack-glance 0 0:2014.1.5-3.el7ost
Red Hat:openstack:5::el7 openstack-glance-doc 0 0:2014.1.5-3.el7ost
Red Hat:openstack:5::el7 python-glance 0 0:2014.1.5-3.el7ost
Red Hat:openstack:6::el7 openstack-glance 0 0:2014.2.3-3.el7ost
Red Hat:openstack:6::el7 openstack-glance-doc 0 0:2014.2.3-3.el7ost
Red Hat:openstack:6::el7 python-glance 0 0:2014.2.3-3.el7ost
Red Hat:openstack:7::el7 openstack-glance 0 0:2015.1.1-3.el7ost
Red Hat:openstack:7::el7 openstack-glance-doc 0 0:2015.1.1-3.el7ost
Red Hat:openstack:7::el7 python-glance 0 0:2015.1.1-3.el7ost
SUSE:OpenStack Cloud 5 openstack-glance 0 2014.2.4.juno-14.1
SUSE:OpenStack Cloud 5 openstack-glance-doc 0 2014.2.4.juno-14.1
Ubuntu:14.04:LTS glance 0 1:2014.1.5-0ubuntu1.1
Ubuntu:16.04:LTS glance 0 2:11.0.0-0ubuntu1
pypi glance 2011.2 No fix
pypi glance 2015.1.0 No fix

Related vulnerabilities