Ceph Object Gateway Header-Splitting Vulnerability Leading to Cross-Site Scripting

A cross-site scripting (XSS) vulnerability has been identified in the Ceph Object Gateway (RADOS Gateway) within the Amazon S3 interface. This issue arises from the improper handling of untrusted input, allowing anonymous users to send requests that could be exploited to inject malicious scripts into objects. The vulnerability affects all versions of Ceph Object Gateway up to the latest release.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an anonymous user must send a request to the Ceph Object Gateway that includes untrusted input not properly neutralized. This can be done by targeting a publicly readable object with a size sufficient to accommodate the injected content.

Remediation

Users can upgrade to Ceph versions 15.2.1, 14.2.9, or 13.2.9 to address this vulnerability.