Bug #43607: mgr/dashboard: fix improper URL checking - Dashboard - Ceph

Actions

Copy link

Bug #43607

closed

Feature #47765: mgr/dashboard: security improvements

mgr/dashboard: fix improper URL checking

Added by Ernesto Puerta over 4 years ago. Updated about 3 years ago.

Status:

Resolved

Priority:

Immediate

Assignee:

Ernesto Puerta

Category:

General - Back-end

Target version:

Ceph - v15.0.0

% Done:

Source:

Community (user)

Tags:

Backport:

nautilus

Regression:

Severity:

1 - critical

Reviewed:

Affected Versions:

Ceph - v14.2.5, Ceph - v14.2.6, Ceph - v15.0.0

ceph-qa-suite:

Pull request ID:

32652

Crash signature (v1):

Crash signature (v2):

Description

From https://github.com/rook/rook/issues/4635

Only release 14.2.5 and above show this behaviour (including master) introduced in https://github.com/ceph/ceph/pull/30694.

Assigned CVE-2020-1699

CWE-22

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Ernesto Puerta over 4 years ago

Priority changed from High to Immediate
Tags set to security
Severity changed from 2 - major to 1 - critical

Actions

Copy link

Updated by Ernesto Puerta over 4 years ago

Status changed from New to In Progress
Pull request ID set to 32652

Actions

Copy link

Updated by Lenz Grimmer over 4 years ago

Unfortunately the referenced rook issue does not provide any details about the problem. In regular deployments, the Mgr process does not run with root privileges, so the dashboard module should not be able to access any sensitive files. Is this different from how Ceph is deployed by Rook?

Actions

Copy link

Updated by Ernesto Puerta over 4 years ago

Description updated (diff)
Affected Versions v14.2.5, v14.2.6, v15.0.0 added

Actions

Copy link

Updated by Ernesto Puerta over 4 years ago

Private changed from Yes to No

Actions

Copy link

Updated by Ernesto Puerta over 4 years ago

Lenz Grimmer wrote:

Unfortunately the referenced rook issue does not provide any details about the problem. In regular deployments, the Mgr process does not run with root privileges, so the dashboard module should not be able to access any sensitive files. Is this different from how Ceph is deployed by Rook?

As mentioned by e-mail, anything under ceph:ceph ownership could be exposed, and depending on the deployment setup that might mean a lot:
- Ceph keyrings
- Ceph logs (ceph-mgr exposes sensitive information as described in https://tracker.ceph.com/issues/37503, including ceph-dashboard admin password, RGW secrets, etc).
- Ceph daemon data (/var/lib/ceph)
- procfs info from Ceph processes

Actions

Copy link