AI analysis
OpenStack Zaqar before 22.0.2 mishandles the URL-Signature header in its WSGI transport, so a request carrying an empty URL-Signature value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project's UUID can exploit this to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions; by additionally claiming an administrative role, the attacker can also perform admin operations such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not. The flaw is rated critical (CVSS 4.0: 9.2), but successful exploitation requires prior knowledge of a victim project's UUID, which limits purely opportunistic attacks. No public PoC exists, there is no evidence of exploitation in the wild, and the CVE is not on CISA's KEV list.
What to do: Upgrade Zaqar to 22.0.2 or later as soon as possible. If patching is delayed, restrict network access to the Zaqar WSGI endpoint (typically port 8888) to trusted internal networks, verify that only intended auth strategies are configured, and review logs for requests with empty URL-Signature headers or unexpected queue, message, claim, and subscription activity. Treat project UUIDs as sensitive identifiers and rotate any that may have leaked, since knowing a project's UUID is a prerequisite for this attack.
Affected
| OpenStack Zaqar (WSGI transport with an authentication strategy configured) | before 22.0.2 |
Estimated exposure
nichelikely on the order of hundreds to a few thousand deployments worldwide — Zaqar is an optional, comparatively low-adoption OpenStack messaging component that is typically deployed behind internal API networks in private clouds, and no reliable public count of internet-exposed Zaqar WSGI endpoints is available.
Description
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.