Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration
    dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before
    Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary
    web script or HTML via a crafted template. (CVE-2014-3473)

OpenStack Dashboard was updated to fix bugs and security issues.

Full changes :

  - Update to version horizon-2013.2.5.dev2.g9ee7273 :

  - fix Horizon login page DOS attack (bnc#908199,     CVE-2014-8124)

  - update version to 2013.2.5

  - Updated from global requirements

  - Pin docutils to 0.9.1

  - Set python hash seed to 0 in tox.ini

  - Check host is not none in each availability zone

  - Fix XSS issue with the unordered_list filter     (bnc#891815, CVE-2014-3594)

  + 0001-Use-default_project_id-for-v3-users.patch     (manually)

  - Replace UserManager with None in tests

  - Update test-requirements to fix sphinx build_doc

  - Fix multiple Cross-Site Scripting (XSS) vulnerabilities     (bnc#885588, CVE-2014-3473, CVE-2014-3474,     CVE-2014-3475)

  - Fix issues with importing the Login form

    Bug 869696 - Admin password injection on Horizon     Dashboard is broken.

  - Update to version horizon-2013.2.4.dev8.g07c097f :

  - Bug fix on neutron's API to return the correct target ID

  - Fix display of images in Rebuild Instance

  - Get instance networking information from Neutron

  - Bump stable/havana next version to 2013.2.4

  - Do not release FIP on disassociate action

  - Introduces escaping in Horizon/Orchestration 2013.2.3     (bnc#871855, CVE-2014-0157)

  - Update to version horizon-2013.2.3.dev8.g3d04c3c :

  - Reduce number of novaclient calls

  - Don't copy the flavorid when updating flavors

  - Allow snapshots of paused and suspended instances

  - Fixing tests to work with keystoneclient 0.6.0

  - Bump stable/havana next version to 2013.2.3

  + Use upstream URL as source (enables verification)

  + Import translations for Havana 2013.2.2 udpate

  - Update to version 2013.2.2.dev29.g96bd650 :

  + Update Transifex resource name for havana

  + Fix inappropriate logouts on load-balanced Horizon

  - Update to version 2013.2.2.dev25.g6508afd :

  + disable volume creation, when cinder is disabled

  + Bad workflow-steps check: has_required_fields

  + Specify tenant_id when retrieving LBaaS/VPNaaS resource

  - Update to version 2013.2.2.dev19.g7a8eadc :

  + Give HealthMonitor a proper display name

  - Update to version 2013.2.2.dev17.gaa55b24 :

  + Common keystone version fallback

  - Move settings.py (default settings) to branding-upstream     subpackage: a branding package might want to change some     default settings.

  - add 0001-Common-keystone-version-fallback.patch,     0001-Use-default_project_id-for-v3-users.patch

  - Update to version 2013.2.2.dev15.g2b6dfa7 :

  + fix help text in 'Create An image' window

  + Change how scrollShift is calculated

  + unify keypair name handling

  - Add     0001-Give-no-background-color-to-the-pie-charts.patch:
    do not give a background color to pie charts.

  - Update to version 2013.2.2.dev9.gc6d38a1 :

  + Wrong marker sent to keystone

  - Update to version 2013.2.2.dev7.g2e11482 :

  + Adding management_url to test mock client

  - add     0001-Bad-workflow-steps-check-has_required_fields.patch 

  - Make python-horizon require the 2013.2 version of     python-horizon-branding (and not the 2013.2.xyz     version). This makes it easier to create non-upstream     branding; we already do this for the other branding     subpackage.

  - Update to version 2013.2.2.dev6.g2c1f1f3 :

  + Add check for BlockDeviceMappingV2 nova extension

  + Gracefully handle Users with no email attribute

  + Import install_venv from oslo

  + Bump stable/havana next version to 2013.2.2

  - Update to version 2013.2.1.dev41.g9668e80 :

  + Updated from global requirements

  - put everything under /srv/www/openstack-dashboard 

  - Update to version 2013.2.1.dev40.g852e5c8 :

  + Import translations for Havana 2013.2.1 udpate

  + Deleting statistics tables from resource usage page

  + Allow 'Working' in spinner to be translatable

  + lbaas/horizon - adds tcp protocol choice when create lb

  + Fix a bug some optional field in LBaaS are mandatory

  + Fix bug so that escaped html is not shown in volume     detach dialog

  + Role name should not be translated in Domain Groups     dialog

  + Fix incomplete translation of 'Update members' widget

  + Fix translatable string for 'Injected File Path Bytes'

  + Add extra extension file to makemessage command line

  + Add contextual markers to BatchAction messages

  + Logging user out after self password change

  + Add logging configuration for iso8601 module

  + Ensure all compute meters are listed in dropdown

  + Fix bug by escaping strings from Nova before displaying     them (bnc#852175, CVE-2013-6858)

  - add/use generic openstack-branding provides 

  - Update to version 2013.2.1.dev9.g842ba5f :

  + Fix default port of MS SQL in security group template

  + Provide missing hover hints for instance:<type> meters

  + translate text: 'subnet'/'subnet details'

  + Change 'Tenant' to 'Project'

  + Avoid discarding precision of metering data

  - Use Django's signed_cookies session backend like     upstream and drop the usage of cache_db

  - No need to set SECRET_KEY anymore, upstream learned it     too

python-django_openstack_auth was updated to 1.1.3 :

  - Various i18n fixes

  - Revoke tokens when logging out or changing the tenant

  - Run tests locally, therefore merge test package back     into main

  - Properly build HTML documentation and install it

  - Add pt_BR locale

  - Updated (build) requirements

  - Add django_openstack_auth-hacking-requires.patch:
    hacking dep is nonsense

  - include tests runner 

  - add -test subpackage

The remote Solaris system is missing necessary patches to address security updates.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2323-1 advisory.

    Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat     templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct     cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into     viewing server output during a crafted server request, a remote attacker could exploit this to modify the     contents, or steal confidential data, within the same domain. (CVE-2014-3473)

    Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when     creating networks. If a user were tricked into launching an image using the crafted network name, an     attacker could conduct cross-site scripting attacks. (CVE-2014-3474)

    Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding     users. If an admin user were tricked into viewing the users page containing a crafted email address, an     attacker could conduct cross-site scripting attacks. (CVE-2014-3475)

    Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input     sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates     page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks.
    (CVE-2014-3594)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
433782	SCA: security update for horizon (GHSA-8vwv-2v7v-jmgr)	Tenable Cloud Security	SCA Checks	medium
433782	SCA: security update for horizon (GHSA-8vwv-2v7v-jmgr)	Tenable Self-Hosted Container Security	SCA Checks	medium
80842	openSUSE Security Update : openstack-dashboard (openSUSE-SU-2015:0078-1)	Nessus	SuSE Local Security Checks	medium
80637	Oracle Solaris Third-Party Patch Update : horizon (multiple_cross_site_scripting_xss1)	Nessus	Solaris Local Security Checks	medium
77323	Ubuntu 14.04 LTS : OpenStack Horizon vulnerabilities (USN-2323-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-3473

medium

Tenable Plugins

medium

medium

medium

medium

medium