CVE-2021-3509: XSS
A flaw was found in ceph. In order to make the JWT token inaccessible through XSS, it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookie are used in the body of the HTTP response for the documentation, which again makes it available to XSS.
References:
https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409
Other sources
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nautilusto a version that resolves this vulnerability.Fixed in 14.2.20 - Upgrade
Upgrade
redhat/octopusto a version that resolves this vulnerability.Fixed in 15.2.11 - Upgrade
Upgrade
redhat/pacificto a version that resolves this vulnerability.Fixed in 16.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3509?
CVE-2021-3509 has been assigned a high severity rating due to its potential exploitation in XSS attacks.
How do I fix CVE-2021-3509?
To mitigate CVE-2021-3509, upgrade to Red Hat Ceph Storage versions 14.2.20, 15.2.11, or 16.2.3.
Which versions of Red Hat Ceph Storage are affected by CVE-2021-3509?
CVE-2021-3509 affects Red Hat Ceph Storage versions prior to 14.2.20, 15.2.11, and 16.2.3.
What components are impacted by CVE-2021-3509?
CVE-2021-3509 impacts the Dashboard component of Red Hat Ceph Storage.
Is there an official patch for CVE-2021-3509?
Yes, official patches are available in the form of upgrades to specific version releases for Red Hat Ceph Storage.