Overview
This report details a significant vulnerability, identified as CVE-2025-26515, that affects previous versions of StorageGRID prior to 11.8.0.15 and 11.9.0.8 without Single Sign-On enabled. This vulnerability poses a serious threat as it can potentially allow an unauthenticated attacker to alter the password of any non-federated Grid Manager or Tenant Manager user. The severity of this vulnerability is underscored by its potential to compromise systems and lead to data leakage.
Vulnerability Summary
CVE ID: CVE-2025-26515
Severity: High, CVSS score: 7.5
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
StorageGRID | versions prior to 11.8.0.15
StorageGRID Webscale | versions prior to 11.9.0.8
How the Exploit Works
This exploit takes advantage of a Server-Side Request Forgery (SSRF) vulnerability in StorageGRID. By sending a maliciously crafted request, an unauthenticated attacker can trick the server into changing the password of any non-federated Grid Manager or Tenant Manager user. This could potentially allow the attacker to gain unauthorized access to the system and possibly leak sensitive data.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. The attacker sends a malicious HTTP POST request, targeting the password change function of the server.
POST /api/change_password HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"username": "victim_user",
"new_password": "attacker_password"
}In this example, `victim_user` would be the username of the targeted Grid Manager or Tenant Manager user and `attacker_password` would be the new password set by the attacker.