I don't know how we'll address this. Realistically, I think this is
going to have to be marked as invalid/wont fix/opinion. I'm going to
mark it as wont fix, we can circle back on it if there is more
discussion to be had.
** Changed in: keystone
Status: New => Won't Fix
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1795800
Title:
Username enumeration via response timing difference
Status in OpenStack Identity (keystone):
Won't Fix
Status in OpenStack Security Advisory:
Won't Fix
Bug description:
This issue is being treated as a potential security risk under
embargo. Please do not make any public mention of embargoed (private)
security vulnerabilities before their coordinated publication by the
OpenStack Vulnerability Management Team in the form of an official
OpenStack Security Advisory. This includes discussion of the bug or
associated fixes in public forums such as mailing lists, code review
systems and bug trackers. Please also avoid private disclosure to
other individuals not already approved for access to this information,
and provide this same reminder to those who are made aware of the
issue prior to publication. All discussion should remain confined to
this private bug report, and any proposed fixes should be added to the
bug as attachments.
The response times for POST /v3/auth/tokens are significantly higher
for valid usernames compared to those of invalid ones, making it
possible to enumerate users on the system.
Examples:
# For invalid username
+ Request
POST /v3/auth/tokens HTTP/1.1
Host: hostname:5000
Connection: close
Content-Length: 141
Content-Type: application/json
{"auth":{"identity":{"methods":
["password"],"password":{"user":{"name":
"nonexisting","domain":{"name": "Default"},"password":
"devstacker"}}}}}
+ Response Time: <150ms
# For valid username ('admin' in this case)
+ Request
POST /v3/auth/tokens HTTP/1.1
Host: hostname:5000
Connection: close
Content-Length: 139
Content-Type: application/json
{"auth":{"identity":{"methods":
["password"],"password":{"user":{"name": "admin","domain":{"name":
"Default"},"password": "devstacker"}}}}}
+ Response time: >600ms
# Tested version
v3.8
[UPDATE 3 Oct 2018 5:01 AEST]
Looks like it's also possible to enumerate for valid "domain" too. There're 2
ways that I can see:
* With valid username: use the above user enum bug to guess the valid
username, then brute the "domain" parameter. Response times are significantly
higher for valid compared to invalid domains.
* Without valid username: get a baseline response time using invalid username
AND invalid domain name. Bruteforce the "domain" param until the response time
hits an average high. For me invalid domain falls in the 90-100ms range whereas
valid ones show 100+ms. This one looks a bit more obscure i.e. timing
difference is not as distinguishable, but should still be recognisable with a
good sample size.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1795800/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
