CVE-2016-4428

What it actually does

Authenticated users can inject malicious AngularJS templates into Horizon dashboard forms, bypassing sanitization and executing arbitrary script in other users' browsers with the victim's session context.

Why it matters to the business

Attackers with low-privilege dashboard access could steal session tokens, modify displayed data, or perform actions on behalf of other administrators, increasing risk of unauthorized cloud resource changes or data exposure in OpenStack environments.

How an attack unfolds

An attacker authenticates to the Horizon dashboard, locates a form that accepts AngularJS template input, embeds a malicious expression that triggers on render, and waits for other users to load the affected page so the script executes under their privileges.

How to fix it

Upgrade OpenStack Horizon to a version beyond 9.0.1 that includes input sanitization for AngularJS templates; apply vendor patches for affected OpenStack and Red Hat distributions; enforce strict content security policies and disable unnecessary template rendering features until patched.

How to confirm the fix worked

Review Horizon release notes and package versions against known fixed releases; test forms for template injection by submitting safe Angular expressions and confirming they are escaped; scan dashboard source for updated sanitization logic around user-supplied templates.

Typical attack path

1. Obtain valid credentials for a Horizon user account
2. Navigate to a vulnerable dashboard form accepting template input
3. Submit an AngularJS expression containing malicious JavaScript
4. Induce other authenticated users to view the injected content
5. Execute actions such as token theft or UI manipulation in victim context

How to detect it

Inspect web server and Horizon application logs for unusual form submissions containing AngularJS syntax such as double curly braces or ng- directives; monitor for unexpected script execution events or changes to dashboard content viewed by multiple users.

• {{constructor.constructor
• ng-app
• ng-bind-html
• angular.module

What your security team should do

• Prioritize patching Horizon instances given the authenticated attack surface
• Audit all custom or third-party dashboard plugins for similar template handling
• Implement web application firewall rules to block common AngularJS expression patterns
• Review logs for anomalous form submissions containing template syntax