Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T00:18:07.683Z",
  "pubdate": "2026-08-28T00:18:07.683Z",
  "executiveSummary": "Ceph Object Gateway (RGW) contains a vulnerability in its AWS Signature Version 4 (SigV4) implementation, specifically related to the validation of header signatures.\nThe vulnerability allows an attacker in possession of a presigned URL to inject arbitrary x-amz-* headers that are not included in the 'X-Amz-SignedHeaders' set.\nUnlike the AWS S3 specification, which mandates that all x-amz-* headers must be signed, the RGW component fails to reject requests containing unsigned headers.\nThis flaw enables unauthorized privilege escalation, as attackers can attach headers that modify request behavior or grant permissions beyond the scope intended by the original signer.\nThe vulnerability affects Ceph versions prior to 20.2.4 and 19.2.6. Successful exploitation requires an attacker to intercept or obtain a legitimate presigned URL, which can then be manipulated to perform unauthorized storage operations or bypass access control policies.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the AWS SigV4 request validation logic within the Ceph Object Gateway (RGW).\nIn the AWS SigV4 protocol, the 'X-Amz-SignedHeaders' header list informs the server which specific headers were included in the signature calculation. The protocol dictates that any header prefixed with 'x-amz-' must be included in the canonicalized header string and subsequently signed to ensure integrity and authenticity.\nCeph RGW’s parser correctly identifies the headers explicitly listed in 'X-Amz-SignedHeaders' for signature verification, but it fails to enforce a 'deny-by-default' policy for other 'x-amz-*' headers present in the request.\nBecause the RGW handler ignores extra unsigned headers rather than rejecting the request, an attacker can append arbitrary headers to a presigned PUT request. These headers are processed by the RGW backend as if they were valid parts of the request, despite lacking cryptographic integrity verification.\nThe attack flow proceeds as follows: 1) The attacker obtains a valid presigned URL generated for a specific resource (e.g., a PUT operation). 2) The attacker appends unauthorized 'x-amz-*' headers to the HTTP request that were not part of the original signing process. 3) The RGW component validates the signature only against the headers defined in the attacker-provided (or original) 'X-Amz-SignedHeaders' list, ignoring the malicious headers added to the request. 4) The RGW logic honors the injected headers, allowing the attacker to influence gateway behavior—such as modifying object metadata, access control lists (ACLs), or storage classes—potentially escalating their privileges within the object store context.\nThis vulnerability effectively bypasses the integrity constraints of the SigV4 mechanism, enabling the manipulation of request parameters that the original signer did not authorize.\nThe issue persists across versions 19.2.x and 20.2.x prior to the identified patch versions. No authentication is required beyond the possession of a presigned URL, and the exposure is inherent to any network-accessible Ceph RGW instance supporting S3-compatible SigV4 requests."
}