PT-2021-5810 · Red Hat+5 · Red Hat Ceph Storage+5

Pedro Sampaio · Published 2021-04-15 · Updated 2022-04-25 · CVE-2021-3509

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage version 4

Description A flaw was found in the Dashboard component of Red Hat Ceph Storage, where the JWT token was moved from localStorage to an httpOnly cookie in response to a previous issue. However, the token cookies are used in the body of the HTTP response for documentation, making it available to XSS attacks. The greatest threat to the system is for confidentiality, integrity, and availability. Exploitation of this issue may allow a remote attacker to impact data integrity.

Recommendations For Red Hat Ceph Storage version 4, consider disabling the use of token cookies in the HTTP response body for documentation as a temporary workaround until a patch is available. Restrict access to the Dashboard component to minimize the risk of exploitation. Avoid using the token cookie in the affected HTTP response until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1819

ALT-PU-2021-1830

ALT-PU-2021-2332

BDU:2022-00286

CVE-2021-3509

OPENSUSE-SU-2021:0833-1

OPENSUSE-SU-2021:1834-1

OPENSUSE-SU-2021_0833-1

OPENSUSE-SU-2021_1834-1

OPENSUSE-SU-2024:10676-1

RHSA-2021:2445

SUSE-SU-2021:1834-1

SUSE-SU-2021:1835-1

SUSE-SU-2021_1834-1

SUSE-SU-2021_1835-1

USN-4998-1

USN-5128-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Hat Ceph Storage

Suse

Ubuntu

References · 43

• 🔥 https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409 · Exploit
• https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10ca · Patch
• https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b · Patch
• https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27 · Patch
• https://ubuntu.com/security/notices/USN-5128-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3509 · Security Note
• https://ubuntu.com/security/CVE-2020-27781 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1835-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20288 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1950116 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00286 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0833-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3509 · Vendor Advisory