Ceph RadosGW Authentication Bypass Vulnerability via JWT with 'none' Algorithm

An authentication bypass vulnerability has been identified in Ceph RadosGW OIDC provider, affecting versions through 19.2.0. The issue arises from the acceptance of JSON Web Tokens (JWT) that use 'none' as the algorithm, allowing the bypass of signature verification. This vulnerability was discovered during a penetration test.

Impact

Exploitation of this vulnerability allows for authentication bypass, potentially leading to unauthorized access or actions within the application.

Reproduction

To reproduce this vulnerability, send a JWT with 'none' as the algorithm to the Ceph RadosGW endpoint. The JWT signature will not be verified, bypassing authentication. This can be done using a tool that allows manipulation of JWTs, such as a JWT debugger or a custom script.