CVE-2015-5245: CRLF Injection
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Other sources
Upstream reports:
PCI scans have determined that the RGW is returning whatever string it thought was the name of the bucket requested as raw text in the Bucket response header, which we are using to be able to track request/response cycles by bucket. The result is that things like this are possible (note the extra Content-type header):
<snip> $ curl -i "objects.dreamhost.com/nothing-to-see-here%22%0D%0AContent-type%3A%20%22image-jpg";echo HTTP/1.1 400 Bad Request Bucket: "nothing-to-see-here" Content-type: "image-jpg" Content-Length: 83 Accept-Ranges: bytes Content-type: application/xml Date: Mon, 27 Jul 2015 22:57:11 GMT
<Error><Code>InvalidBucketName</Code></Error> </snip>
This could be considerably worse. It is in fact trivial to make the RGW return invalid HTTP responses this way as well (the resulting response is from HAProxy rejecting the invalid response from the RGW, as it should):
</snip> $ curl -i "objects.dreamhost.com/nothing-to-see-here%22%0D%0AContent-Length%3A%20%2282";echo HTTP/1.0 502 Bad Gateway Cache-Control: no-cache Connection: close Content-Type: text/html
<html><body><h1>502 Bad Gateway</h1> The server returned an invalid or incomplete response. </body></html> </snip>
The RGW needs to sanitize/clean-up the bucket name before including it in the bucket header, by encoding the data in a standard encoding so that it is impossible to do things like inserting new headers, data, etc.. that looks like meaningful parts of a real HTTP response.
External reference: http://tracker.ceph.com/issues/12537
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5245?
CVE-2015-5245 is classified as a high severity vulnerability due to its potential to allow remote attackers to conduct HTTP response splitting attacks.
How do I fix CVE-2015-5245?
To fix CVE-2015-5245, upgrade the Ceph Object Gateway to version 0.94.4 or later.
What systems are affected by CVE-2015-5245?
CVE-2015-5245 affects the Ceph Object Gateway in versions before 0.94.4.
What type of attack can be executed due to CVE-2015-5245?
CVE-2015-5245 allows attackers to inject arbitrary HTTP headers, facilitating HTTP response splitting attacks.
Is there a workaround for CVE-2015-5245 if I cannot update?
Currently, there is no documented workaround for CVE-2015-5245; upgrading is the recommended mitigation.