AI analysis
OpenStack Octavia before 18.0.1 fails to reject control characters (such as newlines) in the redirect_url and redirect_prefix fields of L7 policies. Because the RFC 3986 URL validator percent-encodes control characters before validating, values containing newlines pass structural checks, but Octavia writes the raw unencoded value directly into the HAProxy configuration generated on the amphora load balancer instance. An authenticated project member who owns a load balancer can exploit this via a REDIRECT_TO_URL L7 policy to inject arbitrary HAProxy directives on the amphora, potentially redirecting or intercepting tenant traffic, poisoning backend connections, or disrupting availability for any tenant whose traffic crosses that amphora. Only deployments using the Amphora provider driver are affected; other provider drivers are not. The flaw is rated critical (CVSS 4.0: 9.4) due to high impact on the amphora and subsequent systems it fronts, but there is no known public proof of concept and it is not listed in the CISA KEV catalog.
What to do: Upgrade Octavia to 18.0.1 or later, which rejects control characters in L7 policy redirect_url and redirect_prefix fields. If immediate upgrade is not possible, audit existing L7 policies for embedded newlines or other control characters in those fields, consider stripping or denying such values at the Octavia API front end, and restrict load-balancer-creation rights to trusted tenants. After remediation, rebuild or reconfigure affected amphorae (failover or LB rebuild) so no injected HAProxy directives persist, and review amphora HAProxy configs and tenant traffic logs for signs of prior injection.
Affected
| Open Infrastructure Foundation (OpenStack) OpenStack Octavia (Amphora provider driver) | before 18.0.1 |
Estimated exposure
moderate≈1,000–10,000 OpenStack/Octavia deployments worldwide (estimate), each potentially serving many tenants — Octavia is the default load-balancer service in modern OpenStack releases and the Amphora provider is its standard driver, but OpenStack runs almost entirely in private and provider data centers; public scan counts of OpenStack control…
Description
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.