CVE-2021-3524: Input Validation

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when making the CORS request. The highest threat from this vulnerability is to integrity.

It was reported that "newline" character in the CORS xml configuration file in the ExposeHeader tag can lead to the header injection attack. When the CORS request is made the response contain the injected header. Using newline characters injected into the HTTP headers, it is possible for the malicious user to add arbitrary headers such as Set-Cookie to set arbitrary cookies.

This impacts the RHCS RadosGW S3 API. For example malicious user could create a publicly-accessible S3 bucket with such CORS configuration and anyone that accessed that bucket would have these headers injected.

In addition, in contrast to the prior fix, \r can be used as a separator, and is not fixed in the prior patch, which only handled \n separators.

— Red Hat