OpenStack Network Exporter HTTP Header Timeout DoS

Executive Summary

This vulnerability is in the openstack-network-exporter component where the HTTP server lacks essential timeout settings like ReadHeaderTimeout. An unauthenticated remote attacker can send slow HTTP header bytes to keep connections open indefinitely, consuming server resources such as file descriptors. This leads to a Denial of Service (DoS) that disrupts Prometheus metric scraping and alerting.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for unusually slow HTTP header connections to port 1981. Use tools like netstat or ss to check for excessive open connections from the same source. Check Prometheus metrics scraping logs for failures or timeouts during metric collection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt monitoring capabilities by preventing Prometheus from scraping metrics and triggering alerts. It may cause resource exhaustion on the server, leading to degraded performance or outages for telemetry services. However, it does not impact data confidentiality, integrity, or core OpenStack services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily disrupts monitoring capabilities by causing Denial of Service (DoS) through resource exhaustion, which may indirectly impact compliance with standards like GDPR or HIPAA that require continuous monitoring and logging. However, the vulnerability itself does not directly expose or compromise sensitive data, so its impact on compliance is secondary and depends on the specific regulatory requirements for monitoring systems.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to the openstack-network-exporter service by configuring firewall rules to allow connections only from trusted hosts. Set timeout parameters on the HTTP server such as ReadHeaderTimeout: 10 seconds, ReadTimeout: 30 seconds, WriteTimeout: 30 seconds, and IdleTimeout: 60 seconds.

Useful 0 Not Useful 0