CVE-2023-6110

What it actually does

Improper input validation allows deletion of a non-existent access rule to inadvertently remove unrelated existing access rules outside the intended scope.

Why it matters to the business

Organizations may experience unintended loss of access rule configurations, increasing the risk of disrupted identity and access management workflows and potential exposure of resources.

How an attack unfolds

An authenticated user with limited privileges submits a delete request for a non-existent access rule within their scope; the flawed validation logic matches and removes other existing access rules not tied to application credentials, resulting in unauthorized configuration changes.

How to fix it

Apply the vendor-supplied patch for OpenStack components handling access rule deletion once released; restrict low-privileged users from access rule management operations until fixed; monitor for unexpected access rule removals.

How to confirm the fix worked

Review access rule deletion audit logs for entries where a single delete action removes multiple rules or rules outside the requester's explicit scope; test the delete operation against a non-existent rule in a controlled environment after patching.

Typical attack path

1. Obtain low-privileged authenticated access to the OpenStack deployment
2. Identify or guess a non-existent access rule identifier
3. Issue a delete request for the fabricated identifier
4. Observe deletion of unrelated access rules in the environment

How to detect it

Examine identity service logs for delete operations on access rules that reference non-existent identifiers yet result in multiple rule removals; correlate with user activity to identify anomalous deletion patterns.

What your security team should do

• Prioritize patching OpenStack identity services as soon as fixed versions become available
• Implement additional logging and alerting on access rule deletion events
• Review and tighten role-based permissions for access rule management
• Conduct periodic audits of existing access rules to detect unexpected removals