CVE-2021-3524

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage RadosGW (Ceph Object Gateway) versions prior to 14.2.21

Description A flaw was found in the Red Hat Ceph Storage RadosGW related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. This issue is also related to insufficient input validation, which may allow a remote attacker to impact data integrity.

Recommendations For versions prior to 14.2.21, update to version 14.2.21 or later to resolve the issue. As a temporary workaround, consider restricting access to the CORS configuration file to minimize the risk of exploitation. Avoid using the newline character in the ExposeHeader tag until the issue is resolved.