CVE-2016-3703: Medium severity red hat openshift vulnerability
Jordan Liggitt of Red Hat reports:
Malicious content can be loaded via the API proxy via a GET request if: 1. an authorized accesstoken is provided as a query parameter 2. anonymous access is granted to the service/proxy or pod/proxy API for the pod serving the content
That content has same-domain access to the browser localStorage if the web console and API server are hosted on the same domain. This gives the malicious content access to the logged in user's API credentials.
Other sources
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an accesstoken in the query parameter.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3703?
CVE-2016-3703 is classified as a high severity vulnerability due to potential unauthorized access to sensitive API credentials.
How do I fix CVE-2016-3703?
To mitigate CVE-2016-3703, users should upgrade Red Hat OpenShift Enterprise to version 3.3 or later, which has addressed this vulnerability.
Who is affected by CVE-2016-3703?
CVE-2016-3703 affects users of Red Hat OpenShift Enterprise versions 3.1 and 3.2 that have enabled anonymous access to services or pods.
What can attackers achieve with CVE-2016-3703?
Attackers exploiting CVE-2016-3703 can access API credentials stored in web browser localStorage, potentially leading to further exploitation.
Is there a workaround for CVE-2016-3703 before upgrading?
Yes, temporarily disabling anonymous access to the affected services can serve as a workaround until an upgrade is completed for CVE-2016-3703.