Uploaded image for project: 'Eucalyptus'
  1. Eucalyptus
  2. EUCA-1717

Walrus: anyone can access objects on Walrus by submitting correctly signed requests

    Details

    • Benefit:
      Medium
    • Security:
      Yes
    • Rank:
      0|i018yv:

      Description

      Walrus accepts internal requests from NC based on a custom REST protocol. To
      authenticate such requests, it verifies that the signature (over some headers
      in the request) of the request is correct, but the certificate that is used to
      verify the signature is taken from the request itself. The assumption is that
      it's an NC's certificate. However, since Walrus does not validate that the
      submitted key is a valid key of an NC, anyone can submit a request to Walrus
      using an arbitrary pair of key/cert. As a result, Walrus will return any
      requested object. It looks like at least the following operations are
      supported in place of EucaOperation: "GetDecryptedImage", "GetObject",
      "HttpPut" and any object (not just images) can be read this way. All an
      attacker needs to do is to guess an object location on Walrus.

        Gliffy Diagrams

          Lucidchart Diagrams

            Attachments

              Activity

                People

                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: