Overview
The vulnerability CVE-2024-48916 is a major concern for any organization using the Ceph storage platform. As a distributed object, block, and file storage platform, Ceph is integral to a wide range of IT systems and cloud networks. This vulnerability affects Ceph versions 19.2.3 and below, specifically in the RadosGW OIDC provider. The vulnerability allows for unvalidated JSON Web Tokens (JWTs) to be sent, bypassing the signature check by using “none” as the JWT algorithm. This opens the door for potential system compromise or data leakage, which could have far-reaching consequences for any organization storing sensitive information on affected systems.
Vulnerability Summary
CVE ID: CVE-2024-48916
Severity: High (CVSS 8.1)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Ceph | 19.2.3 and below
How the Exploit Works
The exploit takes advantage of a flaw in the Ceph system’s handling of JWTs. When a JWT with “none” as its algorithm is sent, the Ceph system does not validate the signature. This allows an attacker to forge JWTs, bypassing normal security checks and gaining unauthorized access to the system. This vulnerability is most likely in the RadosGW OIDC provider, a component of the Ceph system that handles identity and access management.
Conceptual Example Code
Here’s a conceptual example of how an attacker might exploit this vulnerability. The attacker sends an HTTP request to the Ceph system with a forged JWT:
POST /auth/token HTTP/1.1
Host: ceph.example.com
Content-Type: application/jwt
{
"alg": "none",
"typ": "JWT"
}
{
"sub": "admin",
"name": "Admin",
"iat": 1516239022
}In this example, the attacker is forging a JWT that identifies them as an admin. Because the “alg” field is set to “none”, the Ceph system does not validate the signature, allowing the attacker to gain admin access.
Mitigation Guidance
No known patched version has been published at the time of writing. As a temporary mitigation, organizations can apply a vendor patch or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block malicious JWTs. Organizations should also monitor vendor communications for updates on a patched version.