[CVE-2015-5245] RGW returns requested bucket name raw in "Bucket" response header
|Tags:||Affected Versions:||Ceph - v0.80.10|
PCI scans have determined that the RGW is returning whatever string it thought was the name of the bucket requested as raw text in the Bucket response header, which we are using to be able to track request/response cycles by bucket. The result is that things like this are possible (note the extra Content-type header):
$ curl -i "objects.dreamhost.com/nothing-to-see-here%22%0D%0AContent-type%3A%20%22image-jpg";echo
HTTP/1.1 400 Bad Request
Date: Mon, 27 Jul 2015 22:57:11 GMT
This could be considerably worse. It is in fact trivial to make the RGW return invalid HTTP responses this way as well (the resulting response is from HAProxy rejecting the invalid response from the RGW, as it should):
$ curl -i "objects.dreamhost.com/nothing-to-see-here%22%0D%0AContent-Length%3A%20%2282";echo
HTTP/1.0 502 Bad Gateway
<html><body><h1>502 Bad Gateway</h1>
The server returned an invalid or incomplete response.
The RGW needs to sanitize/clean-up the bucket name before including it in the bucket header, by encoding the data in a standard encoding so that it is impossible to do things like inserting new headers, data, etc.. that looks like meaningful parts of a real HTTP response.
This is on the following package versions:
- Ceph version 0.80.10-1-g364151a (364151acb8d5cd4e2ad8c670c5882bf1be48a6ac)
- Radosgw with CivetWeb 0.80.10-1-g364151a-1precise
#6 Updated by Ken Dreyer 11 months ago
Please see https://www.owasp.org/index.php/HTTP_Response_Splitting for an explanation about HTTP header manipulation attacks.