Joshua Baergen [Wed, 17 May 2023 18:17:09 +0000 (12:17 -0600)]
CVE-2023-43040 rgw: Fix bucket validation against POST policies
It's possible that user could provide a form part as a part of a POST
object upload that uses 'bucket' as a key; in this case, it was
overriding what was being set in the validation env (which is the real
bucket being modified). The result of this is that a user could actually
upload to any bucket accessible by the specified access key by matching
the bucket in the POST policy in said POST form part.
Fix this simply by setting the bucket to the correct value after the
POST form parts are processed, ignoring the form part above if
specified.
Ilya Dryomov [Tue, 2 Mar 2021 14:09:26 +0000 (15:09 +0100)]
auth/cephx: ignore CEPH_ENTITY_TYPE_AUTH in requested keys
When handling CEPHX_GET_AUTH_SESSION_KEY requests from nautilus+
clients, ignore CEPH_ENTITY_TYPE_AUTH in CephXAuthenticate::other_keys.
Similarly, when handling CEPHX_GET_PRINCIPAL_SESSION_KEY requests,
ignore CEPH_ENTITY_TYPE_AUTH in CephXServiceTicketRequest::keys.
These fields are intended for requesting service tickets, the auth
ticket (which is really a ticket granting ticket) must not be shared
this way.
Otherwise we end up sharing an auth ticket that a) isn't encrypted
with the old session key even if needed (should_enc_ticket == true)
and b) has the wrong validity, namely auth_service_ticket_ttl instead
of auth_mon_ticket_ttl. In the CEPHX_GET_AUTH_SESSION_KEY case, this
undue ticket immediately supersedes the actual auth ticket already
encoded in the same reply (the reply frame ends up containing two auth
tickets).
Kotresh HR [Tue, 1 Dec 2020 10:44:17 +0000 (16:14 +0530)]
tasks/cephfs/test_volume_client: Add tests for authorize/deauthorize
1. Add testcase for authorizing auth_id which is not added by
ceph_volume_client
2. Add testcase to test 'allow_existing_id' option
3. Add testcase for deauthorizing auth_id which has got it's caps
updated out of band
Optionally allow authorizing auth-ids not created by ceph_volume_client
via the option 'allow_existing_id'. This can help existing deployers
of manila to disallow/allow authorization of pre-created auth IDs
via a manila driver config that sets 'allow_existing_id' to False/True.
Kotresh HR [Thu, 26 Nov 2020 09:18:16 +0000 (14:48 +0530)]
pybind/ceph_volume_client: Preserve existing caps while authorize/deauthorize auth-id
Authorize/Deauthorize used to overwrite the caps of auth-id which would
end up deleting existing caps. This patch fixes the same by retaining
the existing caps by appending or deleting the new caps as needed.
This patch disallow the ceph_volume_client to authorize the auth_id
which is not created by ceph_volume_client. Those auth_ids could be
created by other means for other use cases which should not be modified
by ceph_volume_client.
Fixes: https://tracker.ceph.com/issues/48555 Signed-off-by: Ramana Raja <rraja@redhat.com> Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 3a85d2d04028a323952a31d18cdbefb710be2e2b)
Neha Ojha [Thu, 3 Dec 2020 19:18:04 +0000 (19:18 +0000)]
messages/MMonCommand, MMonCommandAck: don't log values for "config set" and "config-key set"
This acts like a big hammer to avoid adding sensitive information, like passwords
into mon/mgr/cluster logs when using "config set" and "config-key set" to set keys
whose values should be secure.
Casey Bodley [Tue, 26 May 2020 19:03:03 +0000 (15:03 -0400)]
rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
the values in the <ExposeHeader> element are sent back to clients in a
Access-Control-Expose-Headers response header. if the values are allowed
to have newlines in them, they can be used to inject arbitrary response
headers
this issue only affects s3, which gets these values from an xml document
in swift, they're given in the request header
X-Container-Meta-Access-Control-Expose-Headers, so the value itself
cannot contain newlines
Signed-off-by: Casey Bodley <cbodley@redhat.com> Reported-by: Adam Mohammed <amohammed@linode.com>
Origin: upstream, https://github.com/ceph/ceph/pull/35773
Robin H. Johnson [Fri, 27 Mar 2020 19:48:13 +0000 (20:48 +0100)]
rgw: reject control characters in response-header actions
S3 GetObject permits overriding response header values, but those inputs
need to be validated to insure only characters that are valid in an HTTP
header value are present.
Credit: Initial vulnerability discovery by William Bowling (@wcbowling)
Credit: Further vulnerability discovery by Robin H. Johnson <rjohnson@digitalocean.com> Signed-off-by: Robin H. Johnson <rjohnson@digitalocean.com>
Origin: upstream, https://github.com/ceph/ceph/pull/34504/commits/9ca5b3628245e2878426602bb24f1a4e45edc850
Signed-off-by: Matt Benjamin <mbenjamin@redhat.com> Reviewed-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit d8dd5e513c0c62bbd7d3044d7e2eddcd897bd400)
Or Friedmann [Wed, 15 Jan 2020 19:15:53 +0000 (21:15 +0200)]
rgw: improve beast
Avoid leaking connections that had partially-consumed
client data on unexpected disconnect.
Resolves CVE-2020-1700 (moderate impact flaw).
Fixes: https://tracker.ceph.com/issues/42531 Signed-off-by: Or Friedmann <ofriedma@redhat.com> Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
Origin: upstream, https://github.com/ceph/ceph/commit/ff72c50a2c43c57aead933eb4903ad1ca6d1748a
Andrew Kryczka [Tue, 23 May 2017 17:29:14 +0000 (10:29 -0700)]
[PATCH 3/3] Core-local statistics
Summary:
This diff changes `StatisticsImpl` from a thread-local approach to a core-local one. The goal is to perform faster aggregations, particularly for applications that have many threads. There should be no behavior change.
Closes https://github.com/facebook/rocksdb/pull/2258
Andrew Kryczka [Fri, 12 May 2017 16:26:40 +0000 (09:26 -0700)]
[PATCH 2/3] core-local array type conversions
Summary:
try to clean up the type conversions and hope it passes on windows.
one interesting thing I learned is that bitshift operations are special: in `x << y`, the result type depends only on the type of `x`, unlike most arithmetic operations where the result type depends on both operands' types.
Closes https://github.com/facebook/rocksdb/pull/2277
Andrew Kryczka [Thu, 11 May 2017 01:16:31 +0000 (18:16 -0700)]
[PATCH 1/3] CoreLocalArray class
Summary:
Moved the logic for core-local array out of ConcurrentArena and into a separate class because I want to reuse it for core-local stats.
Closes https://github.com/facebook/rocksdb/pull/2256
[ Stefano Rivera ]
* Collection of minor security updates for Ceph.
* CVE-2020-27781: Privilege Escalation: User credentials could be manipulated
and stolen by Native CephFS consumers of OpenStack Manila, resulting in
potential privilege escalation. An Open Stack Manila user can request
access to a share to an arbitrary cephx user, including existing users.
The access key is retrieved via the interface drivers. Then, all users of
the requesting OpenStack project can view the access key. This enables the
attacker to target any resource that the user has access to. This can be
done to even "admin" users, compromising the ceph administrator.
* CVE-2021-20288: Potential Privilege Escalation: When handling
CEPHX_GET_PRINCIPAL_SESSION_KEY requests, ignore CEPH_ENTITY_TYPE_AUTH in
CephXServiceTicketRequest::keys.
* CVE-2020-1760: XSS: A flaw was found in the Ceph Object Gateway, where it
supports request sent by an anonymous user in Amazon S3. This flaw could
lead to potential XSS attacks due to the lack of proper neutralization of
untrusted input.
* CVE-2020-25678: Information Disclosure: ceph stores mgr module passwords
in clear text. This can be found by searching the mgr logs for grafana and
dashboard, with passwords visible.
* CVE-2019-10222: Denial of service: An unauthenticated attacker could crash
the Ceph RGW server by sending valid HTTP headers and terminating the
connection, resulting in a remote denial of service for Ceph RGW clients.
* CVE-2020-10753 and CVE-2021-3524: Header Injection: It was possible to
inject HTTP headers via a CORS ExposeHeader tag in an Amazon S3 bucket. The
newline character in the ExposeHeader tag in the CORS configuration file
generates a header injection in the response when the CORS request is
made.
* CVE-2020-12059: Denial of Service: A POST request with an invalid tagging
XML could crash the RGW process by triggering a NULL pointer exception.
* CVE-2020-1700: Denial of Service: A flaw was found in the way the Ceph RGW
Beast front-end handles unexpected disconnects. An authenticated attacker
can abuse this flaw by making multiple disconnect attempts resulting in a
permanent leak of a socket connection by radosgw. This flaw could lead to
a denial of service condition by pile up of CLOSE_WAIT sockets, eventually
leading to the exhaustion of available resources, preventing legitimate
users from connecting to the system.
* CVE-2021-3531: Denial of Service: When processing a GET Request in Ceph
Storage RGW for a swift URL that ends with two slashes it could cause the
rgw to crash, resulting in a denial of service.
* CVE-2021-3979: Loss of Confidentiality: A key length flaw was found in
Ceph Storage. An attacker could exploit the fact that the key length is
incorrectly passed in an encryption algorithm to create a non random key,
which is weaker and can be exploited for loss of confidentiality and
integrity on encrypted disks.
[ Bastien Roucariès ]
* CVE-2023-43040: A flaw was found in Ceph RGW. An unprivileged
user can write to any bucket(s) accessible by a given key
if a POST's form-data contains a key called 'bucket'
with a value matching the name of the bucket used to sign
the request. The result of this is that a user could actually
upload to any bucket accessible by the specified access key
as long as the bucket in the POST policy matches the bucket
in said POST form part. (Closes: #1053690)
Andrew Kryczka [Tue, 23 May 2017 17:29:14 +0000 (10:29 -0700)]
Core-local statistics
Summary:
This diff changes `StatisticsImpl` from a thread-local approach to a core-local one. The goal is to perform faster aggregations, particularly for applications that have many threads. There should be no behavior change.
Closes https://github.com/facebook/rocksdb/pull/2258
Andrew Kryczka [Fri, 12 May 2017 16:26:40 +0000 (09:26 -0700)]
core-local array type conversions
Summary:
try to clean up the type conversions and hope it passes on windows.
one interesting thing I learned is that bitshift operations are special: in `x << y`, the result type depends only on the type of `x`, unlike most arithmetic operations where the result type depends on both operands' types.
Closes https://github.com/facebook/rocksdb/pull/2277
Andrew Kryczka [Thu, 11 May 2017 01:16:31 +0000 (18:16 -0700)]
CoreLocalArray class
Summary:
Moved the logic for core-local array out of ConcurrentArena and into a separate class because I want to reuse it for core-local stats.
Closes https://github.com/facebook/rocksdb/pull/2256
Andrew Kryczka [Tue, 23 May 2017 17:29:14 +0000 (10:29 -0700)]
Core-local statistics
Summary:
This diff changes `StatisticsImpl` from a thread-local approach to a core-local one. The goal is to perform faster aggregations, particularly for applications that have many threads. There should be no behavior change.
Closes https://github.com/facebook/rocksdb/pull/2258
Andrew Kryczka [Fri, 12 May 2017 16:26:40 +0000 (09:26 -0700)]
core-local array type conversions
Summary:
try to clean up the type conversions and hope it passes on windows.
one interesting thing I learned is that bitshift operations are special: in `x << y`, the result type depends only on the type of `x`, unlike most arithmetic operations where the result type depends on both operands' types.
Closes https://github.com/facebook/rocksdb/pull/2277
Andrew Kryczka [Thu, 11 May 2017 01:16:31 +0000 (18:16 -0700)]
CoreLocalArray class
Summary:
Moved the logic for core-local array out of ConcurrentArena and into a separate class because I want to reuse it for core-local stats.
Closes https://github.com/facebook/rocksdb/pull/2256
Andrew Kryczka [Tue, 23 May 2017 17:29:14 +0000 (10:29 -0700)]
Core-local statistics
Summary:
This diff changes `StatisticsImpl` from a thread-local approach to a core-local one. The goal is to perform faster aggregations, particularly for applications that have many threads. There should be no behavior change.
Closes https://github.com/facebook/rocksdb/pull/2258
Andrew Kryczka [Fri, 12 May 2017 16:26:40 +0000 (09:26 -0700)]
core-local array type conversions
Summary:
try to clean up the type conversions and hope it passes on windows.
one interesting thing I learned is that bitshift operations are special: in `x << y`, the result type depends only on the type of `x`, unlike most arithmetic operations where the result type depends on both operands' types.
Closes https://github.com/facebook/rocksdb/pull/2277
Andrew Kryczka [Thu, 11 May 2017 01:16:31 +0000 (18:16 -0700)]
CoreLocalArray class
Summary:
Moved the logic for core-local array out of ConcurrentArena and into a separate class because I want to reuse it for core-local stats.
Closes https://github.com/facebook/rocksdb/pull/2256
Andrew Kryczka [Tue, 23 May 2017 17:29:14 +0000 (10:29 -0700)]
Core-local statistics
Summary:
This diff changes `StatisticsImpl` from a thread-local approach to a core-local one. The goal is to perform faster aggregations, particularly for applications that have many threads. There should be no behavior change.
Closes https://github.com/facebook/rocksdb/pull/2258
Andrew Kryczka [Fri, 12 May 2017 16:26:40 +0000 (09:26 -0700)]
core-local array type conversions
Summary:
try to clean up the type conversions and hope it passes on windows.
one interesting thing I learned is that bitshift operations are special: in `x << y`, the result type depends only on the type of `x`, unlike most arithmetic operations where the result type depends on both operands' types.
Closes https://github.com/facebook/rocksdb/pull/2277
Andrew Kryczka [Thu, 11 May 2017 01:16:31 +0000 (18:16 -0700)]
CoreLocalArray class
Summary:
Moved the logic for core-local array out of ConcurrentArena and into a separate class because I want to reuse it for core-local stats.
Closes https://github.com/facebook/rocksdb/pull/2256
projects / ceph.git / log