Bug 1199427 - (CVE-2022-1655) VUL-0: CVE-2022-1655: openstack-dashboard: OpenStack: Horizon session cookies are not flagged HttpOnly
VUL-0: CVE-2022-1655: openstack-dashboard: OpenStack: Horizon session cookies...
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P3 - Medium : Major
: ---
Assigned To: Guang Yee
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2022-05-11 08:47 UTC by Hu
Modified: 2022-05-30 11:19 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Hu 2022-05-11 08:47:14 UTC


Description of problem:

- An internal security audit discovered that Horizon session cookies are being created without the HttpOnly flag even though we set HorizonSecureCookies to true in our environment files.

- According to the KCS article at https://access.redhat.com/solutions/4764241 the relevant Django flag should be set manually in the dashboard configuration file.

Version-Release number of selected component (if applicable):

- Red Hat OpenStack 16.2.1 (Z1)

Actual results:

- From the Customer point of view, the workaround described in KCS 4764241 is unacceptable because those modifications would get lost every time the overcloud configuration is updated by TripleO and it would require a manual intervention on all controllers followed by a restart of the dashboard.

Expected results:

- The customer expectation is a fix (set of HttpOnly via Tripleo) of this problem in a next Z stream of OSP 16.2

Additional info:

- OpenStack recommendations on Cookies, related to the OpenStack O&M Dashboard (Horizon GUI), are available at: https://docs.openstack.org/security-guide/dashboard/cookies.html

- In term of common consequences, connected to the missing HttpOnly flag in the Cookies related to the O&M OpenStack Dashboard (Horizon GUI), these could identified in these two areas [1][2]

[1] Confidentiality impact:               
If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.

[2] Integrity impact:
If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., JWT and refresh token are written back to the browser in HTTP cookies. HttpOnly prevents JavaScript from accessing them, making them less vulnerable to theft. ) and assume the identity of the user.

Comment 1 Hu 2022-05-11 08:47:36 UTC
 - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/openstack-dashboard   12.0.5~dev6
 - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/openstack-dashboard   14.1.1~dev11
Comment 2 Guang Yee 2022-05-26 23:48:01 UTC
Looks like we already have this setting in our Horizon local_settings.py


for both cloud 8 [1] and cloud 9 [2].

1. https://git.ci.prv.suse.net/cgit/ardana/horizon-ansible/tree/roles/HZN-WEB/templates/local_settings.py?h=release/suse-openstack-cloud/8#n84
2. https://git.ci.prv.suse.net/cgit/ardana/horizon-ansible/tree/roles/HZN-WEB/templates/local_settings.py#n84

Is this sufficient?
Comment 3 Hu 2022-05-30 11:19:15 UTC
I think should be okay, thanks!
Comment 4 Hu 2022-05-30 11:19:50 UTC