CyberRota Analysis
AI-GeneratedThe vulnerability affects Ceph versions prior to 20.2.4 and 19.2.6, where the Monitor subscription handler improperly authorizes access to the configuration-key store, allowing any CephX user with `mon allow r` capabilities to read sensitive secrets. This includes critical information such as OSD LUKS disk-encryption passphrases and SSH private keys, potentially enabling a low-privileged user to escalate privileges and compromise the entire cluster. Organizations using affected versions of Ceph should prioritize upgrading to the patched versions to mitigate the risk of unauthorized access and potential full system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6