CyberRota Analysis
AI-GeneratedThe OpenStack Glance location API prior to version 32.0.1 is vulnerable due to insufficient validation of destination hosts when adding HTTP locations to images, allowing authenticated users to point to internal endpoints like the cloud metadata service. This could lead to unauthorized data exposure, as attackers can retrieve sensitive information by downloading image data. Organizations using OpenStack Glance with the HTTP store backend should prioritize patching to mitigate this high-severity vulnerability.
Original NVD Description
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.