A critical cryptographic vulnerability in the Ceph RADOS Gateway allows low-privileged users to escalate to full administrative access, posing a severe risk to storage infrastructure integrity.

This vulnerability involves the use of an unauthenticated AES-128-CBC cryptographic handler for STS session tokens, which allows an attacker with a standard user token to perform bit-flipping attacks to modify administrative flags. This enables a low-privileged authenticated user to bypass all capability checks and achieve global administrative access.

The exploitation of this vulnerability permits unauthorized actors to gain full administrative control over the Ceph storage platform. This leads to a total compromise of data confidentiality, integrity, and availability, as an attacker can manipulate, delete, or exfiltrate sensitive stored objects and blocks. With a CVSS score of 8.8, this high-severity flaw requires immediate remediation to prevent the potential for widespread data breaches and system sabotage.

Immediate Action: Upgrade to Ceph version 20.2.4 or 19.2.6 immediately to implement the required message authentication for STS tokens.

Proactive Monitoring: Review RGW access logs for unusual administrative activity or rapid, repeated token modification attempts that deviate from standard user behavior.

Compensating Controls: While a WAF may not inspect the internal contents of encrypted STS tokens, restricting access to the RGW S3 endpoint via network-level controls can limit the attack surface for untrusted entities.

Public Exploit Available: Unknown

Given the severity of potential administrative escalation, organizations should treat this update as a high-priority task. Security teams must verify their current Ceph version and apply the recommended patches to both the 19.x and 20.x branches immediately to neutralize the risk of unauthorized privilege elevation.