CVE-2021-3563

Root

Cause OpenStack Keystone's application credential API only verifies the first 72 characters of a secret, ignoring any characters beyond that [3]. Administrators may rely on password complexity rules (e.g., via password_regex) to enforce strong secrets, but this enforcement does not apply to application credentials, and even if a longer secret is set, only a prefix is checked [3].

Exploitation

An attacker who obtains or guesses an application credential's ID—potentially via other vulnerabilities such as bug 1901207 [3]—can attempt to authenticate using a weak or truncated secret. The lack of lockout mechanisms for the application credential API further increases the attack surface, allowing brute-force attempts without rate limiting [3].

Impact

Successful exploitation could allow an attacker to authenticate as the application credential owner, leading to unauthorized access to data and resources. The confidentiality and integrity of the OpenStack environment are at risk [1][2].

Mitigation

Patches are available in Keystone version 22.0.1 and later [4]. Debian and Red Hat have issued updates [1][4]. Administrators should upgrade to a fixed version and consider applying additional controls such as stricter monitoring of application credential usage.