CVE-2021-3654
published 2022-03-02CVE-2021-3654: A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
PriorityP347medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
26.79%
97.8th percentile
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nova | < nova 2:23.0.2-3 (bookworm) | nova 2:23.0.2-3 (bookworm) |
| openstack | nova | < 21.2.3 | 21.2.3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 21.2.3 | 21.2.3 |
| openstack | nova | >= 0 < 2:17.0.13-0ubuntu5.3 | 2:17.0.13-0ubuntu5.3 |
| openstack | nova | >= 0 < 2:21.2.4-0ubuntu2.2 | 2:21.2.4-0ubuntu2.2 |
| openstack | nova | >= 0 < 2:13.1.4-0ubuntu4.5+esm1 | 2:13.1.4-0ubuntu4.5+esm1 |
| openstack | nova | >= 22.0.0 < 22.2.3 | 22.2.3 |
| openstack | nova | >= 22.0.0 < 22.2.3 | 22.2.3 |
| openstack | nova | >= 23.0.0 < 23.0.3 | 23.0.3 |
| openstack | nova | >= 23.0.0 < 23.0.3 | 23.0.3 |
| redhat | openstack_platform | — | — |
| redhat | openstack_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
- →Detect open redirect exploitation attempts against noVNC proxy by looking for HTTP requests containing a double-slash followed by an external domain and a URL-encoded path traversal sequence (e.g., `//interact.sh/%2f..`) in the request URI. ↗
- →Alert on HTTP 301/302 redirect responses from the noVNC proxy where the Location header resolves to an external/unexpected domain, indicating a successful open redirect. ↗
- →The vulnerability originates from improper URL validation in noVNC's console proxy; monitor noVNC proxy logs for requests with double-slash (`//`) prefixed hostnames or URL-encoded path traversal (`%2f..`) patterns that could be used to craft a malicious redirect. ↗
- →The root cause is in CPython's URL handling (see bugs.python.org/issue32084); environments using affected CPython versions with openstack-nova noVNC proxy are at risk regardless of Nova version. ↗
- ·This vulnerability only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS according to Ubuntu's security notice; Ubuntu 20.04 LTS and later are not listed as affected for CVE-2021-3654. ↗
- ·On Debian, the vulnerability remains open in bullseye but is resolved in bookworm, forky, sid, and trixie (fixed in 2:23.0.2-3); detection/patching scope should be scoped accordingly. ↗
- ·Red Hat OpenStack Platform 10 (Newton) and 13 (Queens) are listed as out of support scope; no mitigation meeting Red Hat's criteria is available for affected RHOSP versions. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu3.3LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nova vulnerabilities
osv·2023-02-13·CVSS 3.3
CVE-2015-9543 [LOW] nova vulnerabilities
nova vulnerabilities
It was discovered that Nova did not properly manage data logged into the
log file. An attacker with read access to the service's logs could exploit
this issue and may obtain sensitive information. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2015-9543)
It was discovered that Nova did not properly handle attaching and
reattaching the encrypted volume. An attacker could possibly use this issue
to perform a denial of service attack. This issue only affected Ubuntu
16.04 ESM. (CVE-2017-18191)
It was discovered that Nova did not properly handle the updation of domain
XML after live migration. An attacker could possibly use this issue to
corrupt the volume or perform a denial of service attack. This issue only
affected Ubuntu 18.04 LTS. (CVE-2020-1
GHSA
Open Redirect in CPython that affects users of OpenStack Nova
ghsa·2022-03-04
CVE-2021-3654 [MEDIUM] CWE-601 Open Redirect in CPython that affects users of OpenStack Nova
Open Redirect in CPython that affects users of OpenStack Nova
A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
OSV
Open Redirect in CPython that affects users of OpenStack Nova
osv·2022-03-04
CVE-2021-3654 [MEDIUM] Open Redirect in CPython that affects users of OpenStack Nova
Open Redirect in CPython that affects users of OpenStack Nova
A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
OSV
CVE-2021-3654: A vulnerability was found in openstack-nova's console proxy, noVNC
osv·2022-03-02·CVSS 6.1
CVE-2021-3654 [MEDIUM] CVE-2021-3654: A vulnerability was found in openstack-nova's console proxy, noVNC
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Ubuntu
Nova vulnerabilities
vendor_ubuntu·2023-02-13·CVSS 3.3
CVE-2021-3654 [LOW] Nova vulnerabilities
Title: Nova vulnerabilities
Summary: Several security issues were fixed in Nova.
It was discovered that Nova did not properly manage data logged into the
log file. An attacker with read access to the service's logs could exploit
this issue and may obtain sensitive information. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2015-9543)
It was discovered that Nova did not properly handle attaching and
reattaching the encrypted volume. An attacker could possibly use this issue
to perform a denial of service attack. This issue only affected Ubuntu
16.04 ESM. (CVE-2017-18191)
It was discovered that Nova did not properly handle the updation of domain
XML after live migration. An attacker could possibly use this issue to
corrupt the volume or perform a denial of service a
Red Hat
openstack-nova: novnc allows open redirection
vendor_redhat·2021-05-13·CVSS 6.1
CVE-2021-3654 [MEDIUM] CWE-601 openstack-nova: novnc allows open redirection
openstack-nova: novnc allows open redirection
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: openstack-nova (Red Hat OpenStack Platform 10 (Newton)) - Out of support scope
Package: openstack-nova (Red Hat OpenStack Platform 13 (Queens)) - Out of support scope
Debian
CVE-2021-3654: nova - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting ...
vendor_debian·2021·CVSS 6.1
CVE-2021-3654 [MEDIUM] CVE-2021-3654: nova - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting ...
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Scope: local
bookworm: resolved (fixed in 2:23.0.2-3)
bullseye: open
forky: resolved (fixed in 2:23.0.2-3)
sid: resolved (fixed in 2:23.0.2-3)
trixie: resolved (fixed in 2:23.0.2-3)
No detection rules found.
Nuclei
Nova noVNC - Open Redirect
nuclei·CVSS 6.1
CVE-2021-3654 [MEDIUM] Nova noVNC - Open Redirect
Nova noVNC - Open Redirect
Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
Template:
id: CVE-2021-3654
info:
name: Nova noVNC - Open Redirect
author: geeknik
severity: medium
description: Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
impact: |
An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the open redirect vulnerability i
No writeups or analysis indexed.
https://bugs.launchpad.net/nova/+bug/1927677https://bugs.python.org/issue32084https://bugzilla.redhat.com/show_bug.cgi?id=1961439https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251ebhttps://security.gentoo.org/glsa/202305-02https://security.openstack.org/ossa/OSSA-2021-002.htmlhttps://www.openwall.com/lists/oss-security/2021/07/29/2https://bugs.launchpad.net/nova/+bug/1927677https://bugs.python.org/issue32084https://bugzilla.redhat.com/show_bug.cgi?id=1961439https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251ebhttps://security.gentoo.org/glsa/202305-02https://security.openstack.org/ossa/OSSA-2021-002.htmlhttps://www.openwall.com/lists/oss-security/2021/07/29/2
2022-03-02
Published