CVE-2020-12692

Vulnerability

CVE-2020-12692 is a vulnerability in OpenStack Keystone's EC2 credential authentication method. The EC2 API does not implement a time-to-live (TTL) check for the AWS Signature V4 signing process, contrary to typical AWS API behavior which validates that requests are made within a window (commonly 15 minutes) of the signature's timestamp [1][2]. This means that once a valid Authorization header is created, Keystone will accept it indefinitely.

Exploitation

An attacker who can capture a legitimate Authorization header—for example, by sniffing network traffic—can replay that header to the Keystone EC2 API without any time constraint [2][3]. The attack does not require any additional authentication or privileges beyond obtaining the header. The lack of a signature TTL check means the replayed request is treated as valid regardless of when it was originally issued.

Impact

By replaying the captured Authorization header, an attacker can reissue an OpenStack token an unlimited number of times [2][3]. This effectively grants the attacker the same level of access as the original token holder, which could lead to unauthorized operations within the OpenStack environment, such as accessing or modifying resources belonging to other tenants.

Mitigation

The vulnerability is fixed in Keystone versions 15.0.1 and later, and it is not present in versions after 16.0.0 [2][3]. Ubuntu published a security update (USN-4480-1) addressing this issue along with other Keystone vulnerabilities [4]. Operators should upgrade their Keystone deployment to the patched versions to prevent exploitation.