CVE-2014-1948 in Image Registry And Delivery Service
Summary
by MITRE
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/01/2022
The vulnerability identified as CVE-2014-1948 affects the OpenStack Image Registry and Delivery Service known as Glance within specific version ranges from 2013.2 through 2013.2.1 and Icehouse releases prior to icehouse-2. This issue represents a critical information disclosure flaw that arises from improper logging practices within the system's authentication failure handling mechanisms. The vulnerability manifests when the Swift store backend password is inadvertently included in log messages at WARNING level when authentication fails, creating an avenue for unauthorized information access.
The technical flaw stems from the logging implementation within Glance's authentication subsystem where sensitive credentials are not properly sanitized before being written to log files. When authentication attempts fail against the Swift backend storage system, the logging mechanism captures the URL containing the password credential and writes it to the system logs with WARNING level severity. This design flaw violates fundamental security principles of least privilege and secure logging practices, as it exposes authentication credentials in plain text format within easily accessible log files. The vulnerability specifically impacts the Swift store backend integration where Glance interacts with OpenStack's object storage service for image storage management.
The operational impact of this vulnerability is significant as it provides local attackers with direct access to authentication credentials used for Swift backend storage. This exposure enables attackers to potentially gain unauthorized access to image repositories stored in Swift, compromise the integrity of the image delivery system, and potentially escalate privileges within the OpenStack environment. The vulnerability affects organizations using the affected Glance versions in production environments where local file system access is possible, creating a persistent threat vector that could remain undetected for extended periods. Security monitoring systems may inadvertently flag these log entries as legitimate warnings while simultaneously providing attackers with credential information.
Organizations should implement immediate mitigations including upgrading to patched versions of Glance that properly sanitize log output and remove sensitive information before logging. Configuration changes should enforce stricter log level controls to prevent WARNING level messages from containing credential information. The implementation of secure logging practices should include credential obfuscation mechanisms and regular log auditing procedures to detect unauthorized access attempts. Additionally, access controls should be strengthened to limit local file system access to log directories and implement proper log rotation policies. This vulnerability aligns with CWE-532 which addresses information exposure through log files and relates to ATT&CK technique T1562.001 for privilege escalation through credential access, emphasizing the importance of proper credential handling and secure logging practices in cloud infrastructure components.