CVE-2023-43040: IBM Spectrum Fusion HCI improper access control
[Improperly verified POST keys]
Other sources
An unprivileged user can write to any bucket(s) accessible by a given key if a POST’s form-data contains a key called ‘bucket’ with a value matching the name of the bucket used to sign the request. The result of this is that a user could actually upload to any bucket accessible by the specified access key as long as the bucket in the POST policy matches the bucket in said POST form part.
Fix this simply by setting the bucket to the correct value after the POST form parts are processed, ignoring the form part above if specified.
— Red Hat
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
— NVD
IBM Spectrum Fusion HCI could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 12.2.13-0ubuntu0.18.04.11+ - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 15.2.17-0ubuntu0.20.04.6 - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 17.2.6-0ubuntu0.22.04.3 - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 18.2.0-0ubuntu3.1 - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 0.80.11-0ubuntu1.14.04.4+ - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 16.2.11+ - Upgrade
Upgrade
ubuntu/cephto a version that resolves this vulnerability.Fixed in 10.2.11-0ubuntu0.16.04.3+ - Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 16.2.15+ds-0+deb12u2Fixed in 18.2.7+ds-1+deb13u1Fixed in 20.2.4+ds-2 - Compensating control
In Ceph RGW POST processing, set the bucket to the correctly signed bucket after processing all POST form parts, ignoring any form part named 'bucket'.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-43040?
CVE-2023-43040 has been classified with a moderate severity level due to the potential for unauthorized access to bucket data.
How do I fix CVE-2023-43040?
To fix CVE-2023-43040, update your Ceph package to a version above the specified vulnerable versions, such as 12.2.13 for Ubuntu or 16.2.11 for Debian.
What versions of Ceph are affected by CVE-2023-43040?
CVE-2023-43040 affects multiple versions of Ceph, including 12.2.11 to 14.2.21 for Debian and several versions up to 18.2.0-0ubuntu3.1 for Ubuntu.
Can CVE-2023-43040 be exploited remotely?
Yes, an unprivileged user can exploit CVE-2023-43040 remotely by crafting a specially formatted POST request to access any writable bucket.
Is there a workaround for CVE-2023-43040?
While a direct workaround is not specified, restricting user permissions on bucket access can help mitigate the risks associated with CVE-2023-43040.