OpenStack Network Exporter Authentication Bypass via TLS Misconfiguration

Executive Summary

This vulnerability affects openstack-network-exporter. When TLS is misconfigured or omitted, the basic authentication mechanism is bypassed, allowing adjacent network attackers to access sensitive OVS and OVN metrics without credentials. This includes bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.

Useful 0 Not Useful 0

Detection Guidance

Check if the openstack-network-exporter is listening on all interfaces (0.0.0.0:1981) without TLS. Use netstat -tulnp | grep 1981 or ss -tulnp | grep 1981 to verify. If exposed, an attacker could access metrics without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to scrape sensitive metrics, enumerate OVS bridges, OVN cluster state, and host topology. This may lead to information disclosure but does not grant administrative control or code execution. The impact is limited to adjacent or intra-cluster network access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive network and system metrics, potentially violating data protection requirements under GDPR and HIPAA. Exposure of such information may result in non-compliance with privacy and security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Bind the exporter to localhost only using --web.listen-address=localhost:1981 in the service configuration. Restrict access via firewall rules to port 1981. Ensure TLS is properly configured to enforce basic-auth.

Useful 0 Not Useful 0