CVE-2015-9543

What it actually does

The flaw writes consoleauth tokens into service log files via NovaProxyRequestHandlerBase.new_websocket_client, allowing any party with log read access to obtain tokens that grant console access to virtual machines in novncproxy setups.

Why it matters to the business

Compromised log access can lead to unauthorized takeover of virtual machine consoles, exposing sensitive workloads and data in affected cloud deployments; the issue has been public for over six years with stable but low exploit likelihood.

How an attack unfolds

An attacker first obtains read access to Nova service logs, locates the leaked consoleauth tokens written during websocket client initialization, then replays those tokens against the novncproxy endpoint to attach to and interact with target virtual machine consoles.

How to fix it

Upgrade OpenStack Nova to 18.2.4, 19.1.0, 20.1.0 or later; for the usvn/usvn package apply commit 08401edbd528c8e3b07bca9a4b320ca1c9d91424. Restrict file-system permissions on all log directories and rotate any tokens that may have been exposed.

How to confirm the fix worked

After upgrade, inspect recent log samples for absence of token strings, confirm the patched websocketproxy.py is deployed, and attempt console connections only with freshly issued tokens.

Typical attack path

1. Obtain read access to Nova service log files
2. Parse logs for consoleauth token strings emitted by websocketproxy.py
3. Submit captured tokens to novncproxy to establish unauthorized console sessions

How to detect it

Review Nova log files and novncproxy access logs for unexpected token values or console attachment events that do not correlate with legitimate user sessions; correlate with authentication events around the time of log entries.

What your security team should do

• Apply the listed fixed versions or commit without delay
• Harden log file ACLs so only authorized processes and analysts can read them
• Audit console access logs for tokens or sessions originating outside expected sources