From: Joshua Baergen <jbaergen@digitalocean.com>
Date: Wed, 17 May 2023 18:17:09 +0000 (-0600)
Subject: CVE-2023-43040 rgw: Fix bucket validation against POST policies
X-Git-Tag: archive/raspbian/12.2.11+dfsg1-2.1+rpi1+deb10u1^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=d7812d3c55d7f009d28e075120dccc19b1f9ad0e;p=ceph.git

CVE-2023-43040 rgw: Fix bucket validation against POST policies

It's possible that user could provide a form part as a part of a POST
object upload that uses 'bucket' as a key; in this case, it was
overriding what was being set in the validation env (which is the real
bucket being modified). The result of this is that a user could actually
upload to any bucket accessible by the specified access key by matching
the bucket in the POST policy in said POST form part.

Fix this simply by setting the bucket to the correct value after the
POST form parts are processed, ignoring the form part above if
specified.

bug: https://tracker.ceph.com/issues/63004
bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053690
bug-debian-security: https://deb.freexian.com/extended-lts/tracker/CVE-2023-43040

Signed-off-by: Joshua Baergen <jbaergen@digitalocean.com>

Gbp-Pq: Name 0033-CVE-2023-43040-rgw-Fix-bucket-validation-against-POS.patch
---

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 2a935f099..b6f3a0a21 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -1574,9 +1574,6 @@ int RGWPostObj_ObjStore_S3::get_params()
     return op_ret;
   }
 
-  ldout(s->cct, 20) << "adding bucket to policy env: " << s->bucket.name
-		    << dendl;
-  env.add_var("bucket", s->bucket.name);
 
   bool done;
   do {
@@ -1628,6 +1625,10 @@ int RGWPostObj_ObjStore_S3::get_params()
     env.add_var(part.name, part_str);
   } while (!done);
 
+  ldout(s->cct, 20) << "adding bucket to policy env: " << s->bucket.name
+		    << dendl;
+  env.add_var("bucket", s->bucket.name);
+
   string object_str;
   if (!part_str(parts, "key", &object_str)) {
     err_msg = "Key not specified";