CVE-2020-12692

EUVD-2020-0098 · Published May 24, 2022

OpenStack Keystone does not check signature TTL of the EC2 credential auth method An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

Technologies

Openstack KeystoneCanonical Ubuntu LinuxKeystone Keystone

Weaknesses

CWE-347CWE-294CWE-311

CVSS scores

v3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Credential Access Discovery Collection

T1190Exploit Public-Facing Application T1005Data from Local System T1040Network Sniffing T1056.004Credential API Hooking T1111Multi-Factor Authentication Interception T1539Steal Web Session Cookie T1552.004Private Keys

References

Potentially impacted assets

See if this affects your attack surface