Greenpepper15

The RADOS Gateway (RGW) uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perform a CBC bit-flip on the `acct type`, `perm type`, and `is admin` fields. By forging the `is admin` value, an attacker can trigger a global administrative override to bypass all capability checks and gain full RGW administrative access. This issue is reachable remotely via the RGW S3 endpoint and requires only a single valid STS token with STS enabled.

The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with `mon allow r` capabilities can read the entire store by sending a crafted MMonSubscribe message. The configuration-key store contains sensitive secrets, such as OSD LUKS disk-encryption passphrases and the SSH private key used by cephadm to access hosts in the cluster. Under default cephadm configurations, this key provides root access to every node, allowing a low-privileged read-only account to achieve full cluster and host compromise.

The Ceph Object Gateway (RGW) SigV4 handler fails to reject requests containing `x-amz-*` headers that are not included in the signed header set. While AWS S3 requires all `x-amz-*` headers in a SigV4 request to be signed, RGW only validates headers listed in `X-Amz-SignedHeaders` and ignores additional unsigned ones, allowing them to take effect. An attacker with a presigned PUT URL can attach arbitrary unsigned `x-amz-*` headers to escalate privileges and gain capabilities beyond what the signer intended.