CVE-2020-26943
📋 TL;DR
This vulnerability allows authenticated users of the OpenStack Horizon dashboard with the blazar-dashboard plugin to execute arbitrary Python code on the Horizon host. The exploit occurs because the application uses the unsafe Python eval() function on user input. All OpenStack deployments using Horizon with the vulnerable blazar-dashboard plugin versions are affected.
💻 Affected Systems
- OpenStack Horizon with blazar-dashboard plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Horizon service host, allowing attackers to execute arbitrary code as the Horizon service user, potentially leading to lateral movement within the OpenStack environment and data exfiltration.
Likely Case
Unauthorized access to the Horizon host, enabling attackers to read sensitive configuration files, modify service behavior, or use the host as a pivot point for further attacks within the cloud infrastructure.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though the Horizon service would still be compromised.
🎯 Exploit Status
Exploitation is straightforward once an attacker has valid Horizon dashboard credentials. The vulnerability is in the Python eval() function usage, making code execution trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: blazar-dashboard 1.3.1, 2.0.0, or 3.0.0
Vendor Advisory: https://launchpad.net/bugs/1895688
Restart Required: Yes
Instructions:
1. Update blazar-dashboard to version 1.3.1, 2.0.0, or 3.0.0 using your package manager. 2. Restart the Horizon service. 3. Verify the fix by checking the installed version.
🔧 Temporary Workarounds
Disable blazar-dashboard plugin
linuxTemporarily disable the vulnerable plugin until patching can be completed
Remove or comment out blazar-dashboard from HORIZON_CONFIG['dashboards'] in local_settings.py
Restart Horizon service: systemctl restart apache2
🧯 If You Can't Patch
- Restrict Horizon dashboard access to only trusted users with strong authentication
- Implement network segmentation to isolate Horizon service from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check installed blazar-dashboard version: pip show blazar-dashboard | grep VersionCheck Version:
pip show blazar-dashboard | grep VersionVerify Fix Applied:
Verify version is 1.3.1, 2.0.0, or 3.0.0: pip show blazar-dashboard | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual Python eval() errors in Horizon logs
- Suspicious user activity in blazar dashboard logs
- Unexpected process execution from Horizon service user
Network Indicators:
- Unusual outbound connections from Horizon host
- Suspicious payloads in Horizon API requests
SIEM Query:
source="horizon.log" AND "eval" AND "error" OR source="apache.log" AND "/blazar/" AND status=200🔗 References
- http://www.openwall.com/lists/oss-security/2020/10/16/5
- https://launchpad.net/bugs/1895688
- https://review.opendev.org/755810
- https://review.opendev.org/755812
- https://review.opendev.org/755813
- https://review.opendev.org/755814
- https://review.opendev.org/756064
- https://security.openstack.org/ossa/OSSA-2020-007.html
- http://www.openwall.com/lists/oss-security/2020/10/16/5
- https://launchpad.net/bugs/1895688
- https://review.opendev.org/755810
- https://review.opendev.org/755812
- https://review.opendev.org/755813
- https://review.opendev.org/755814
- https://review.opendev.org/756064
- https://security.openstack.org/ossa/OSSA-2020-007.html
