CVE-2014-0188: High severity redhat Openshift vulnerability
Luke Meyer of Red Hat reports:
Description of problem: The remote-user auth plugin provides an httpd config file intended to require authentication before setting the REMOTEUSER env var which is passed on to the plugin. However there are passthrough provisions for other forms of auth; in particular, the management console is allowed to set the X-Remote-User header on a request and have that transmuted to the REMOTEUSER env var (by virtue of being a non-proxied local request). When the REMOTEUSER env var is set, the remote-user plugin automatically trusts it. By combining the X-Remote-User header with one of the other passthrough triggers, any user can be impersonated without authenticating at all.
Additional info: Simple workaround: add this in the host httpd conf global config, e.g. at the end of /etc/httpd/conf.d/000002openshiftoriginbrokerproxy.conf:
RequestHeader unset X-Remote-User
Other sources
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the host httpd global config (e.g., in /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf), add: `RequestHeader unset X-Remote-User` to prevent the remote-user auth plugin from trusting the X-Remote-User header and bypassing authentication.
Apache httpd (openshift-origin-broker proxy config / remote-user auth passthrough) RequestHeader unset X-Remote-User = unset
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0188?
CVE-2014-0188 has been classified as a moderate severity vulnerability.
How do I fix CVE-2014-0188?
To fix CVE-2014-0188, update Red Hat OpenShift to the latest version that addresses this vulnerability.
What types of systems are affected by CVE-2014-0188?
CVE-2014-0188 affects specific versions of Red Hat OpenShift platforms, particularly those up to version 2.0.5 and below 1.2.7.
Is CVE-2014-0188 exploitable remotely?
Yes, CVE-2014-0188 can be exploited remotely due to its nature involving authentication bypass in the httpd config.
What are the potential impacts of CVE-2014-0188?
The potential impacts of CVE-2014-0188 include unauthorized access and control over resources intended to be protected.