Summary
OpenStack Glance's Image API v2 contains a server-side request forgery vulnerability when multiple image locations are exposed. An authenticated attacker may manipulate the locations of an image in the queued state through a crafted HTTP PATCH request, potentially causing Glance to make requests to attacker-selected or internal destinations.
Affected context
The issue occurs in deployments where the show_multiple_locations option is enabled in glance-api.conf and clients can update image metadata through the Image API v2. Exploitation is associated with images that remain in the queued state and with deployments where Glance can reach sensitive internal network destinations.
Exploit preconditions
- Attack surface: OpenStack Glance Image API v2
- Required access: Authenticated access with permission to update the relevant image
- Trigger point: A crafted HTTP PATCH request targeting the
locationsattribute of an image in the queued state - Configuration condition:
show_multiple_locationsis enabled - Why exploitation is possible: User-controlled image location data may cause the Glance service to initiate outbound requests to attacker-selected destinations
Why this happens
The vulnerability results from insufficient restriction and validation of user-controlled image location values before they are used by server-side request handling logic. When an authenticated client can alter the location metadata of a queued image, Glance may be induced to resolve or access destinations that were not intended by the service administrator. This behavior maps to CWE-918: Server-Side Request Forgery, in which server-side network requests can be influenced by untrusted input.
Potential impact
- The Glance service may make requests to internal or attacker-controlled endpoints
- Internal services, administrative interfaces, or cloud metadata endpoints could be exposed
- Network segmentation assumptions could be weakened
- Sensitive response data may be disclosed if request handling returns or processes it
- Compromised internal services could enable follow-on attacks
General mitigation guidance
Mitigation generally focuses on reducing trust in client-supplied locations and restricting where server-side requests can go.
Common defensive patterns include:
- Applying strict validation and allowlisting to image location schemes, hosts, and network destinations
- Disabling exposure of multiple image locations when the feature is not required
- Enforcing authorization checks for image-location modification, including queued images
- Blocking access from Glance to cloud metadata services, control-plane endpoints, and unnecessary private networks
- Using egress filtering, network policies, and proxy controls to constrain outbound requests
- Running Glance with only the network and service privileges it requires
How teams detect issues like this
Organizations can identify SSRF exposure through:
- Static analysis and code review of request construction using image locations or other client-controlled URLs
- Review signals involving URL parsing, redirects, backend fetches, and insufficient host or scheme validation
- API policy checks verifying that image-location updates are limited to authorized states and roles
- Network monitoring for Glance connections to private address ranges, metadata services, unexpected domains, or unusual ports
- Automated security testing that supplies internal, loopback, link-local, and redirecting destinations in controlled environments
