By uploading specially crafted application to his tenant and adding this application to the environment in murano user may exploit arbitrary remote code execution vulnerability which affects all version of OpenStack starting from 2014.2 and up.
Any application for murano contains several mandatory artifacts which are defined in YAML or YAML-based language:
* UI Definition - defines user input
* Workflow(s) - defines how application is going to be deployed and general lifecycle events
* Metadata - contains metadata about application: version, author name and so on.
These artifacts are processes by several murano components, and in few places Murano uses class YamlLoader from PyYAML (or descendant of this class) which allows execution arbitrary Python code:
http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPythontypes
One of the places where murano is using YaqlYamlLoader (which is inherited from YamlLoader) is murano-dashboard when it's processing UI Definition file.
Given that any user can upload application and deploy this uploaded application in his tenant this leads to Remote Code Execution on any cloud which has Murano installed and feature of uploading application is enabled for regular users (enabled by default).
We assume for now that all Murano versions are affected starting from OpenStack Juno (2014.2).
Corresponding bugs in Murano tracker:
[python-muranoclient] https://bugs.launchpad.net/python-muranoclient/+bug/1586078
[murano] https://bugs.launchpad.net/murano/+bug/1586079
We continuing exploring where else this may be exploited in Murano.
Draft:
Title: RCE vulnerability in Openstack Murano using insecure YAML tags
Reporter: Kirill Zaitsev
Products: OpenStack Murano
Affects: >=2014.2
Description:
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack Murano applications processing. Using extended YAML tags in Murano application YAML files, an attacker can perform a Remote Code Execution attack.
All setups of Murano are affected.