CVE-2017-7200 in Glance
Summary
by MITRE
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2020
The vulnerability CVE-2017-7200 represents a significant server-side request forgery flaw in OpenStack Glance prior to the Newton release, exposing organizations to sophisticated internal network reconnaissance attacks. This vulnerability specifically affects the Image Service API v1 implementation where the 'copy_from' feature enables remote attackers to manipulate image creation processes by specifying arbitrary URLs for image sources. The flaw stems from inadequate input validation and sanitization within the image import mechanism, allowing malicious actors to craft specially formatted URLs that bypass normal network restrictions and access internal services.
The technical exploitation of this vulnerability leverages the 'copy_from' functionality to perform masked port scanning operations against internal network resources. When an attacker creates an image using a URL such as 'http://localhost:22', the Glance service attempts to fetch the image data from the specified location, inadvertently executing network requests that reveal internal service availability and configuration details. This mechanism effectively transforms the Glance service into a proxy for internal network reconnaissance, as the scanning traffic appears to originate from the legitimate Glance server rather than the attacking party.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with comprehensive internal network mapping capabilities while maintaining operational stealth. Network administrators may fail to detect these reconnaissance activities since they appear to originate from legitimate internal services, potentially enabling more sophisticated attacks such as service enumeration, version fingerprinting, and vulnerability assessment of internal systems. The vulnerability particularly affects organizations relying on OpenStack environments where Glance serves as the primary image management service, creating a persistent attack surface that could facilitate lateral movement within cloud infrastructures.
Organizations should implement comprehensive network segmentation and access controls to limit the exposure of internal services to external scanning attempts. The recommended mitigations include disabling the 'copy_from' functionality for untrusted users, implementing strict URL validation and filtering mechanisms, and deploying network monitoring solutions that can detect anomalous patterns in image import operations. Security controls should also enforce proper authentication and authorization checks for image creation operations, ensuring that only privileged users can leverage the copy_from feature. Additionally, organizations should consider implementing web application firewalls and network access control lists to prevent access to localhost and internal network ranges from the Glance service. This vulnerability aligns with CWE-918, which addresses server-side request forgery issues, and corresponds to ATT&CK technique T1046 for network service scanning and T1059 for command and scripting interpreter usage in cloud environments.