Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE PENDING)

[Jeremy Stanley <fungi () yuggoth org>]

On 2025-11-04 18:15:23 -0500 (-0500), Demi Marie Obenour wrote:
> On 11/4/25 10:01, Jeremy Stanley wrote:
> > =========================================================================
> > OSSA-2025-002: Unauthenticated access to EC2/S3 token endpoints can grant
> >                 Keystone authorization
> > =========================================================================
> >
> > :Date: November 04, 2025
> > :CVE: PENDING
> >
> > Affects
> > ~~~~~~~
> > - Keystone: <26.0.1, ==27.0.0, ==28.0.0
> >
> > Description
> > ~~~~~~~~~~~
> > kay reported a vulnerability in Keystone’s ec2tokens and s3tokens
> > APIs. By sending those endpoints a valid AWS Signature (e.g., from a
> > presigned S3 URL), an unauthenticated attacker may obtain Keystone
> > authorization (ec2tokens can yield a fully scoped token; s3tokens
> > can reveal scope accepted by some services), resulting in
> > unauthorized access and privilege escalation. Deployments where
> > /v3/ec2tokens or /v3/s3tokens are reachable by unauthenticated
> > clients (e.g., exposed on a public API) are affected.
>
> Which account will the tokens belong to?  Is it the one that signed
> the URL?

Correct, if a user shares a signed URL, then that can be used to 
perform other (likely unintended) actions with the account that 
signed it as long as the relevant ec2tokens or s3tokens API methods 
are exposed to the attacker, i.e. not blocked with a WAF or similar.

I've made a note to clarify this in an upcoming errata revision. 
Thanks!
--
Jeremy Stanley

Attachment: signature.asc
Description: