oss-security - Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE PENDING)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aQtvxL3uUpHOd7q8@yuggoth.org>
Date: Wed, 5 Nov 2025 15:39:48 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: [OSSA-2025-002] OpenStack Keystone:
 Unauthenticated access to EC2/S3 token endpoints can grant Keystone
 authorization (CVE PENDING)

On 2025-11-04 18:15:23 -0500 (-0500), Demi Marie Obenour wrote:
>On 11/4/25 10:01, Jeremy Stanley wrote:
>> =========================================================================
>> OSSA-2025-002: Unauthenticated access to EC2/S3 token endpoints can grant
>>                 Keystone authorization
>> =========================================================================
>>
>> :Date: November 04, 2025
>> :CVE: PENDING
>>
>> Affects
>> ~~~~~~~
>> - Keystone: <26.0.1, ==27.0.0, ==28.0.0
>>
>> Description
>> ~~~~~~~~~~~
>> kay reported a vulnerability in Keystone’s ec2tokens and s3tokens
>> APIs. By sending those endpoints a valid AWS Signature (e.g., from a
>> presigned S3 URL), an unauthenticated attacker may obtain Keystone
>> authorization (ec2tokens can yield a fully scoped token; s3tokens
>> can reveal scope accepted by some services), resulting in
>> unauthorized access and privilege escalation. Deployments where
>> /v3/ec2tokens or /v3/s3tokens are reachable by unauthenticated
>> clients (e.g., exposed on a public API) are affected.
>
>Which account will the tokens belong to?  Is it the one that signed
>the URL?

Correct, if a user shares a signed URL, then that can be used to 
perform other (likely unintended) actions with the account that 
signed it as long as the relevant ec2tokens or s3tokens API methods 
are exposed to the attacker, i.e. not blocked with a WAF or similar.

I've made a note to clarify this in an upcoming errata revision. 
Thanks!
-- 
Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.