CVE-2024-48916: Ceph is vulnerable to authentication bypass through RadosGW
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Other sources
Ceph is vulnerable to authentication bypass through RadosGW
— Microsoft
This vulnerability affects the RadosGW OIDC provider by allowing attackers to bypass authentication using JWTs with "none" as the algorithm (alg). The lack of signature enforcement creates a serious risk of unauthorized access and privilege escalation.
The vulnerability is probably in the RadosGW OIDC provider.
PoC
The HTTP request can be found below. But without the JWT:
POST / HTTP/2 Host: storage.xxx.se User-Agent: aws-sdk-go-v2/1.18.0 os/macos lang/go/1.21.1 X:nocoverageredesign md/GOOS/darwin md/GOARCH/arm64 api/sts/1.19.0 Content-Type: application/x-www-form-urlencoded Amz-Sdk-Invocation-Id: 30a74697-7d7e-4c02-b041-97d68156ee78 Amz-Sdk-Request: attempt=1; max=3 Content-Length: 1508 Accept-Encoding: gzip, deflate, br
Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&RoleArn=arn%3Aaws%3Aiam%3A%3Aorgpentest002%3Arole%2Fu-pentest002STS&RoleSessionName=test&Version=2011-06-15&WebIdentityToken=ey..
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 16.2.15+ds-0+deb12u1 - Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 18.2.4+ds-11 - Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 16.2.15+ds-0+deb12u2Fixed in 18.2.7+ds-1+deb13u1Fixed in 20.2.4+ds-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48916?
The severity of CVE-2024-48916 is critical due to the potential for unauthorized access resulting from authentication bypass.
How do I fix CVE-2024-48916?
To mitigate CVE-2024-48916, upgrade to the patched versions of the Ceph package: 14.2.21-1, 16.2.15+ds-0+deb12u1, or 18.2.4+ds-11.
Which software is affected by CVE-2024-48916?
CVE-2024-48916 affects the Ceph RadosGW version up to and including 16.2.11+ds-2.
What are the implications of CVE-2024-48916?
The implications of CVE-2024-48916 include serious security risks due to the ability of attackers to bypass authentication.
Is there a patch available for CVE-2024-48916?
Yes, there are patches available for CVE-2024-48916 in the specified updated versions of the Ceph package.