[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAOo2v=Df__0oyoGc+m5HUH-hcdcZOMwACVawe99X2M2jmVj0vQ@mail.gmail.com>
Date: Tue, 7 Apr 2020 11:59:24 +0530
From: Hardik Vyas <hvyas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-1760 ceph: header-splitting in RGW GetObject has a possible XSS
Hello,
A flaw was found in the Ceph Object Gateway, where it supports
unauthenticated requests sent by an anonymous
user in Amazon S3. This flaw could lead to potential XSS attacks due to the
lack of proper neutralization of
untrusted input. If the attacker knows the path to a publicly readable
object on any RGW cluster and the object
is at least large enough to cover the attack body then it's possible to run
an XSS on any object.
This flaw was introduced with commit
f4a0b2d9260a4523745875e3977a8a1ef9dc5e2e(Oct 9, 2012) and affects
all the way up to master. Red Hat has assigned CVE-2020-1760 for this issue.
Upstream Patches:
https://github.com/ceph/ceph-ci/commit/8aa1f77363ec32bdc57744a143035033291ab5e1
https://github.com/ceph/ceph-ci/commit/18eb4d918b27d362312c29a3bbd57a421897c0a5
https://github.com/ceph/ceph-ci/commit/1bf14094fec34770d2cc74317f4238ccb2dfef98
Credit:
- Initial report to DigitalOcean by William Bowling twitter handle
@wcbowling
- Further evaluation and extension to Robin H. Johnson @robbat2,
rjohnson@...italocean.com
PS: The patches are currently available from ceph.git clone(ceph-ci) and
will be pushed to active releases soon.
Regards,
--
Hardik Vyas / Red Hat Product Security
BD48 C633 DE34 733A BBC3 3B72 8A14 AEBB D68B 9381
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
