Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in the OpenStack Octavia service, specifically within its Amphora provider driver. This issue allows an authenticated user with load balancer ownership to inject arbitrary commands into the HAProxy configuration, potentially leading to significant impacts on affected deployments. The primary concern is confirming whether your environment utilizes the Amphora provider, as other configurations are not susceptible to this flaw.
- Allows injecting commands via load balancer settings.
- Remember that authenticated users can compromise configurations.
- Confirm if your environment uses the Amphora load balancer provider.
Attack Path
How an attacker could exploit the issue
An attacker with project member access to a load balancer can exploit a flaw in how OpenStack Octavia handles URLs. By submitting specially crafted redirect URLs, an attacker can inject malicious commands into the HAProxy configuration, potentially leading to a complete compromise of the affected system. This vulnerability is specific to deployments using the Amphora provider.
- Authenticated access to load balancer management is required.
- Control characters in redirect URLs trigger the vulnerability.
- Risk includes arbitrary HAProxy directive injection.
Live Threat
Current exploitation, exposure, and threat context
In OpenStack Octavia deployments using the Amphora provider, an authenticated project member could inject malicious HAProxy directives. This is possible when control characters, specifically newlines, are included in L7 policy redirect fields, as Octavia does not properly sanitize these values before generating HAProxy configurations.
- Arbitrary HAProxy directives could be injected.
- Control characters in redirect fields allow injection.
- May lead to unauthorized service behavior.
Operational Fix
Recommended remediation, mitigation, and detection steps
Real-World Ownership
For OpenStack Octavia deployments using the Amphora provider, load balancer owners and platform/infrastructure teams are primarily responsible for addressing this vulnerability. The first critical step is to identify all instances of the Amphora provider, confirm their network exposure, and assess their business criticality to prioritize remediation efforts.
- Load balancer owners should initiate review.
- Verify Amphora provider usage and exposure.
- Plan risk-based remediation and vendor coordination.
