yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1927677] Re: Open Redirect in noVNC proxy (CVE-2021-3654)

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: OpenStack Infra <1927677@xxxxxxxxxxxxxxxxxx>
Date: Thu, 29 Jul 2021 17:06:47 -0000
Reply-to: Bug 1927677 <1927677@xxxxxxxxxxxxxxxxxx>
Sender: noreply@xxxxxxxxxxxxx

Reviewed:  https://review.opendev.org/c/openstack/ossa/+/802590
Committed: https://opendev.org/openstack/ossa/commit/08f2c78ccf3688ad2ed44d0c2239742ea1693cdb
Submitter: "Zuul (22348)"
Branch:    master

commit 08f2c78ccf3688ad2ed44d0c2239742ea1693cdb
Author: Jeremy Stanley <fungi@xxxxxxxxxxx>
Date:   Tue Jul 27 17:44:41 2021 +0000

    Add OSSA-2021-002 (CVE-2021-3654)
    
    Change-Id: I1574738a9aa047314c9b933f8bbe032d346cd2d7
    Closes-Bug: #1927677


** Changed in: ossa
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1927677

Title:
  Open Redirect in noVNC proxy (CVE-2021-3654)

Status in OpenStack Compute (nova):
  Fix Released
Status in OpenStack Compute (nova) train series:
  In Progress
Status in OpenStack Compute (nova) ussuri series:
  Fix Committed
Status in OpenStack Compute (nova) victoria series:
  Fix Committed
Status in OpenStack Compute (nova) wallaby series:
  Fix Released
Status in OpenStack Security Advisory:
  Fix Released

Bug description:
  This bug report is related to Security.

  Currently novnc is allowing open direction, which could potentially be
  used for phishing attempts

  To test.
  https://<sites' vnc domain>//example.com/%2F..
  include .. at the end

  For example:
  http://vncproxy.my.domain.com//example.com/%2F..

  It will redirect to example.com. You can replace example.com with some
  legitimate domain or spoofed domain.

  The description of the risk  is
  By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
  Because the server name in the modified link is identical to the original site, phishing attempts may have a more trustworthy appearance.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1927677/+subscriptions