Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields of their own token, and a forged is_admin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T00:17:27.860Z",
  "pubdate": "2026-08-28T00:17:27.860Z",
  "executiveSummary": "Ceph RADOS Gateway (RGW) contains a critical cryptographic vulnerability stemming from the use of unauthenticated AES-128-CBC encryption for STS session tokens. This design flaw allows an attacker to manipulate the integrity of session tokens, leading to unauthorized privilege escalation.\nBy performing a CBC bit-flip attack, an attacker possessing any valid, low-privileged STS token can alter sensitive fields, specifically the 'is_admin' boolean flag. This results in the elevation of the attacker's session to full administrative access across the RGW.\nThe vulnerability is exploitable remotely via the S3 endpoint and does not require an encryption oracle or network sniffing. Successful exploitation grants the attacker global administrative overrides, bypassing all internal capability checks. The vulnerability affects Ceph versions prior to 20.2.4 and 19.2.6. Given the ease of exploitation and the severity of the impact, this constitutes a significant risk to the integrity and confidentiality of the storage platform, allowing for complete administrative compromise of the RGW service.",
  "technicalDetails": "The vulnerability resides in the RGW STS session token handling mechanism, which employs AES-128-CBC for data protection. CBC mode, when used without a Message Authentication Code (MAC) or an Authenticated Encryption with Associated Data (AEAD) construct, is inherently susceptible to malleability attacks.\nThe root cause is the lack of integrity protection for the ciphertext. Because the implementation fails to verify the authenticity of the token after decryption, it is vulnerable to bit-flipping attacks. In CBC mode, flipping a bit in the ciphertext of a block results in a predictable change in the plaintext of the subsequent block. This property allows an attacker to modify specific bytes within the decrypted token structure.\nAn attacker possessing a valid STS token can target the JSON-formatted fields representing account permissions. By calculating the XOR difference between the original ciphertext and the desired modified plaintext, the attacker can selectively flip bits within the 'acct_type', 'perm_type', and 'is_admin' fields. Specifically, modifying the 'is_admin' field to 'true' (or the equivalent binary representation) triggers the RGW logic to grant the session global administrative rights.\nThe attack flow proceeds as follows: 1) The attacker obtains a valid, low-privileged STS session token through standard authentication. 2) The attacker crafts a modified ciphertext payload by performing bit-wise operations on the ciphertext blocks corresponding to the target fields. 3) The attacker submits the manipulated token to the RGW S3 endpoint. 4) The RGW decrypts the token, which now contains the malicious 'is_admin=true' value. 5) The RGW authorization layer processes the manipulated token and, lacking signature or HMAC validation, trusts the integrity of the decrypted data. 6) The RGW grants the attacker administrative access, bypassing subsequent capability checks.\nThe exploitation is entirely self-contained and does not require additional network interaction or access to the decryption key, as the attacker only needs to manipulate the token they already possess. This vulnerability is present in versions prior to 20.2.4 and 19.2.6 where STS is enabled. The post-exploitation impact includes full control over the RGW, potentially allowing data exfiltration, deletion, or further configuration changes."
}