CVE-2017-7200 OpenStack Glance Server-Side Request Forgery (SSRF)
MediumCVSS 5.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glance(PyPI) | < 11.0.0a0 | 11.0.0a0 |
| debian/glance(Debian:12) | < 2:13.0.0-1 | 2:13.0.0-1 |
| debian/glance(Debian:13) | < 2:13.0.0-1 | 2:13.0.0-1 |
| debian/glance(Debian:14) | < 2:13.0.0-1 | 2:13.0.0-1 |
| OpenStack Glance | < 11.0.0 | 11.0.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net third-party-advisory
- bugs.launchpad.net third-party-advisory
- github.com product
- wiki.openstack.org vendor-advisory
- 96988 third-party-advisory vdb-entry
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-7200 vendor-advisory