CVE-2023-43040: IBM Spectrum Fusion HCI improper access control
[Improperly verified POST keys]
Other sources
An unprivileged user can write to any bucket(s) accessible by a given key if a POST’s form-data contains a key called ‘bucket’ with a value matching the name of the bucket used to sign the request. The result of this is that a user could actually upload to any bucket accessible by the specified access key as long as the bucket in the POST policy matches the bucket in said POST form part.
Fix this simply by setting the bucket to the correct value after the POST form parts are processed, ignoring the form part above if specified.
— Red Hat
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
— MITRE
IBM Spectrum Fusion HCI could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-43040?
CVE-2023-43040 has been classified with a moderate severity level due to the potential for unauthorized access to bucket data.
How do I fix CVE-2023-43040?
To fix CVE-2023-43040, update your Ceph package to a version above the specified vulnerable versions, such as 12.2.13 for Ubuntu or 16.2.11 for Debian.
What versions of Ceph are affected by CVE-2023-43040?
CVE-2023-43040 affects multiple versions of Ceph, including 12.2.11 to 14.2.21 for Debian and several versions up to 18.2.0-0ubuntu3.1 for Ubuntu.
Can CVE-2023-43040 be exploited remotely?
Yes, an unprivileged user can exploit CVE-2023-43040 remotely by crafting a specially formatted POST request to access any writable bucket.
Is there a workaround for CVE-2023-43040?
While a direct workaround is not specified, restricting user permissions on bucket access can help mitigate the risks associated with CVE-2023-43040.