Overview
The vulnerability CVE-2024-48916 is a major concern for any organization using the Ceph storage platform. As a distributed object, block, and file storage platform, Ceph is integral to a wide range of IT systems and cloud networks. This vulnerability affects Ceph versions 19.2.3 and below, specifically in the RadosGW OIDC provider. The vulnerability allows for unvalidated JSON Web Tokens (JWTs) to be sent, bypassing the signature check by using “none” as the JWT algorithm. This opens the door for potential system compromise or data leakage, which could have far-reaching consequences for any organization storing sensitive information on affected systems.
Vulnerability Summary
CVE ID: CVE-2024-48916
Severity: High (CVSS 8.1)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Ceph | 19.2.3 and below
How the Exploit Works
The exploit takes advantage of a flaw in the Ceph system’s handling of JWTs. When a JWT with “none” as its algorithm is sent, the Ceph system does not validate the signature. This allows an attacker to forge JWTs, bypassing normal security checks and gaining unauthorized access to the system. This vulnerability is most likely in the RadosGW OIDC provider, a component of the Ceph system that handles identity and access management.
Conceptual Example Code
Here’s a conceptual example of how an attacker might exploit this vulnerability. The attacker sends an HTTP request to the Ceph system with a forged JWT:
POST /auth/token HTTP/1.1
Host: ceph.example.com
Content-Type: application/jwt
{
"alg": "none",
"typ": "JWT"
}
{
"sub": "admin",
"name": "Admin",
"iat": 1516239022
}In this example, the attacker is forging a JWT that identifies them as an admin. Because the “alg” field is set to “none”, the Ceph system does not validate the signature, allowing the attacker to gain admin access.
Mitigation Guidance
No known patched version has been published at the time of writing. As a temporary mitigation, organizations can apply a vendor patch or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block malicious JWTs. Organizations should also monitor vendor communications for updates on a patched version.