On 2025-11-04 18:15:23 -0500 (-0500), Demi Marie Obenour wrote:
On 11/4/25 10:01, Jeremy Stanley wrote:========================================================================= OSSA-2025-002: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization =========================================================================:Date: November 04, 2025 :CVE: PENDING Affects ~~~~~~~ - Keystone: <26.0.1, ==27.0.0, ==28.0.0 Description ~~~~~~~~~~~ kay reported a vulnerability in Keystone’s ec2tokens and s3tokens APIs. By sending those endpoints a valid AWS Signature (e.g., from a presigned S3 URL), an unauthenticated attacker may obtain Keystone authorization (ec2tokens can yield a fully scoped token; s3tokens can reveal scope accepted by some services), resulting in unauthorized access and privilege escalation. Deployments where /v3/ec2tokens or /v3/s3tokens are reachable by unauthenticated clients (e.g., exposed on a public API) are affected.Which account will the tokens belong to? Is it the one that signed the URL?
Correct, if a user shares a signed URL, then that can be used to perform other (likely unintended) actions with the account that signed it as long as the relevant ec2tokens or s3tokens API methods are exposed to the attacker, i.e. not blocked with a WAF or similar.
I've made a note to clarify this in an upcoming errata revision. Thanks!
-- Jeremy Stanley
signature.asc
Description: PGP signature
