CVE-2024-29156

What it actually does

The MuranoPL extension to YAQL in OpenStack Murano does not sanitize the caller-supplied environment, allowing an authenticated user to traverse and read internal service account objects that should remain inaccessible.

Why it matters to the business

Service account credentials or tokens stored inside the Murano environment may be disclosed to ordinary users, increasing the chance of unauthorized access to other OpenStack services and data.

How an attack unfolds

An attacker with access to create or update a Murano environment supplies a crafted YAQL expression that references unsanitized environment variables; the expression is evaluated and the resulting output is returned, exposing sensitive service account details.

How to fix it

Upgrade OpenStack Murano to a build that includes commit 76e7d9e3ad5d7586fac6d686609f83701eb81036 (or later) and ensure YAQL 3.0.0 or newer is used; restart Murano API and engine services after the update.

How to confirm the fix worked

Confirm the deployed Murano package contains commit 76e7d9e3ad5d7586fac6d686609f83701eb81036, run the Murano unit tests that exercise environment sanitization, and verify that attempts to reference service-account objects now return only sanitized results.

Typical attack path

1. Obtain a valid OpenStack user account with Murano access
2. Create or modify a Murano environment containing a malicious YAQL expression
3. Submit the environment for execution or introspection
4. Receive the evaluated result containing leaked service account data

How to detect it

Search Murano API and engine logs for YAQL expressions that reference environment keys known to hold service account data; look for repeated or anomalous environment introspection requests from non-admin users.

What your security team should do

• Apply the fixed commit or newer package immediately on all Murano deployments
• Audit existing Murano environments for any stored secrets and rotate them
• Restrict Murano environment creation privileges to the smallest set of trusted users
• Monitor Murano API logs for unusual YAQL expressions or environment introspection calls