CVE-2021-4180

What it actually does

The flaw exposes the internal IP address or hostname of the OpenStack deployment through the www_authenticate_uri configuration parameter, which is visible to authenticated end users.

Why it matters to the business

Attackers may obtain internal network details that facilitate further reconnaissance or targeted attacks against the environment, increasing operational risk and potential breach scope.

How an attack unfolds

An attacker with low-privileged access inspects the www_authenticate_uri parameter in publicly accessible configuration files to retrieve the internal endpoint details, then leverages that information to map the environment for subsequent exploitation.

How to fix it

Upgrade openstack-tripleo-heat-templates to version 11.6.1 or later and redeploy the affected templates to ensure the parameter no longer discloses internal addresses.

How to confirm the fix worked

Review the rendered configuration files after upgrade to confirm www_authenticate_uri contains only externally resolvable endpoints and perform authenticated configuration retrieval tests to verify the internal value is no longer present.

Typical attack path

1. Obtain authenticated access to the OpenStack deployment
2. Locate and read configuration files containing the www_authenticate_uri parameter
3. Extract the internal IP or hostname value
4. Use the discovered internal endpoint information for additional reconnaissance or attack staging

How to detect it

Search configuration management logs and file repositories for historical references to internal IP addresses or hostnames appearing in www_authenticate_uri values; correlate with authentication events from low-privileged accounts.

What your security team should do

• Prioritize upgrade of openstack-tripleo-heat-templates to 11.6.1 across all deployments
• Audit existing configuration files for exposure of internal endpoints
• Implement least-privilege access controls on configuration stores
• Monitor for unusual authenticated queries targeting configuration endpoints