CyberRota Analysis
AI-GeneratedThe vulnerability affects the CephX authentication protocol in Ceph versions prior to 20.2.4 and 19.2.6, allowing attackers to forge credentials and gain unauthorized cluster-wide access due to the use of a hard-coded initialization vector and lack of message authentication. This flaw enables privilege escalation and manipulation of service tickets, posing a significant risk to the integrity and confidentiality of the storage environment. Organizations using affected versions of Ceph should prioritize upgrading to the patched versions to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.