CVE-2023-6110

Executive Summary

CVE-2023-6110 is a vulnerability in OpenStack that allows an authenticated user to delete access rules that are not associated with any application credentials by attempting to delete a non-existing access rule within their scope. This flaw leads to unauthorized deletion of access rules, potentially disrupting legitimate access controls and security policies. The vulnerability has a CVSS score of 0.0, indicating no official severity rating, but the impact on authorization integrity is significant. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is specific to the OpenStack ecosystem, which is typically deployed as a cloud infrastructure platform.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unrated)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): High (deletion of access rules)
• Availability (A): None

Threat Level: Medium. While the CVSS is unrated, the ability to delete access rules without proper authorization poses a risk to security policy enforcement.

Deep Dive & Mechanics

The vulnerability resides in the OpenStack application credential access rule deletion logic. When a user attempts to delete a non-existing access rule, the system incorrectly processes the request and deletes other existing access rules that are not associated with any application credentials. This occurs due to improper validation of the access rule identifier before deletion.

Root Cause: The deletion function does not verify that the access rule exists and is associated with the requesting user's application credentials before performing the deletion. Instead, it matches the rule ID against a broader set, leading to unintended deletions.

Attack Scenario:

1. An authenticated user with application credentials sends a DELETE request for a non-existing access rule.
2. The system fails to validate the rule's existence and association.
3. The system deletes other access rules that are not linked to any application credentials, potentially affecting other users or services.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def delete_access_rule(user_id, rule_id):
    # No validation of rule existence or association
    db.execute("DELETE FROM access_rules WHERE id = ?", (rule_id,))

Patched Code (Conceptual):

def delete_access_rule(user_id, rule_id):
    # Validate rule exists and is associated with user's application credentials
    rule = db.execute("SELECT * FROM access_rules WHERE id = ? AND user_id = ?", (rule_id, user_id))
    if not rule:
        raise NotFound("Access rule not found")
    db.execute("DELETE FROM access_rules WHERE id = ?", (rule_id,))

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenStack environment with application credentials enabled.
• Valid authentication credentials for a user with application credentials.

Exploitation Steps:

1. Authenticate to the OpenStack API.
2. Identify a target access rule ID that is not associated with any application credentials.
3. Send a DELETE request for a non-existing access rule (e.g., DELETE /v3/access_rules/nonexistent_id).
4. Observe that other access rules are deleted.

Example cURL Command:

curl -X DELETE -H "X-Auth-Token: $TOKEN" \
  "http://openstack-api:5000/v3/access_rules/nonexistent_id"

Blue Team

Detection:

• Monitor API logs for DELETE requests to access rules with non-existing IDs.
• Alert on multiple failed deletion attempts followed by successful deletions of unrelated rules.

Mitigation:

• Apply patches from OpenStack as soon as available.
• Implement strict input validation and authorization checks for all access rule operations.

Indicators of Compromise (IOCs)

• Log Entries: DELETE requests to /v3/access_rules/ with IDs that do not exist in the database.
• Deleted Rules: Access rules that were not associated with any application credentials suddenly removed.
• API Responses: 404 errors for non-existing rules followed by 200 OK for deletions of other rules.

Detection Engineering

YARA Rule

rule CVE_2023_6110_OpenStack_AccessRule_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2023-6110 by deleting non-existing access rules"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6110"
    strings:
        $delete_method = "DELETE" nocase
        $access_rule_path = "/v3/access_rules/" nocase
        $nonexistent_id = "nonexistent" nocase
    condition:
        $delete_method and $access_rule_path and $nonexistent_id
}

Sigma Rule

title: OpenStack Access Rule Deletion Anomaly
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects deletion of non-existing access rules in OpenStack
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: openstack
detection:
    selection:
        http.method: DELETE
        http.url|contains: "/v3/access_rules/"
        http.response.status: 404
    condition: selection
falsepositives:
    - Legitimate attempts to delete rules that were already removed
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6110 OpenStack Access Rule Deletion Attempt";
    flow:to_server;
    http.method; content:"DELETE";
    http.uri; content:"/v3/access_rules/";
    http.uri; content:"nonexistent";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Patch Application: Apply the official patch from OpenStack once released. Monitor the OpenStack security advisory page for updates.
2. Input Validation: Ensure that all access rule deletion requests validate the existence and ownership of the rule before processing.
3. Authorization Checks: Implement strict authorization checks to verify that the user has permission to delete the specific access rule.
4. Logging and Monitoring: Enable detailed logging for all access rule operations and set up alerts for anomalous deletion patterns.
5. Temporary Workaround: If patching is not immediately possible, restrict API access to trusted users only and monitor for suspicious activity.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert