An authenticated project member can execute arbitrary HAProxy configuration commands in OpenStack Octavia, leading to a critical compromise of the load balancer infrastructure.

This is a code injection vulnerability (CWE-94) occurring because the Amphora provider driver fails to sanitize control characters in the tls_ciphers field. An authenticated project member can leverage this flaw to inject newline characters, resulting in the execution of arbitrary HAProxy configuration directives on the amphora instance.

The ability to inject arbitrary configuration directives into HAProxy allows an attacker to manipulate load balancing traffic, bypass security controls, or gain unauthorized access to backend services. Given the CVSS score of 9.4, this vulnerability poses a severe risk to the integrity and availability of the entire OpenStack cloud environment. Successful exploitation could lead to full service compromise and potential lateral movement within the network.

Immediate Action: Upgrade OpenStack Octavia to versions 16.1.0, 17.0.1, or 18.0.1 immediately to apply the necessary input validation patches.

Proactive Monitoring: Monitor HAProxy configuration files for unexpected directives or unauthorized modifications that deviate from standard deployment templates.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users capable of modifying TLS cipher settings until the patch is applied.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this vulnerability and the potential for complete infrastructure compromise, organizations should prioritize the update of all affected OpenStack Octavia instances. Administrators must verify that the Amphora provider is correctly patched to prevent the injection of malicious configuration directives. Prompt remediation is essential to maintain the security posture of the cloud environment.