The vulnerability of the RGWPostObj_ObjStore_S3::get_params() function (rgw_rest_s3.cc) in the RGW storage service of the Ceph system allows a attacker to circumvent security restrictions and upload arbitrary files.

🗓️ 02 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

A Ceph storage service get_params flaw bypasses access control and uploads arbitrary files.

Reporter	Title	Published	Views	Family All 55
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion HCI is vulnerable to unauthorized access due to a flaw in Ceph RGW.	11 May 202416:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Insufficient Granularity of Access Control in Ceph (CVE-2023-43040)	6 Aug 202417:16	–	ibm
GithubExploit	Exploit for Insufficient Granularity of Access Control in Ibm Storage_Fusion_Hci	29 Jul 202417:39	–	githubexploit
Tenable Nessus	Amazon Linux 2 : ceph-common (ALAS-2023-2297)	20 Oct 202300:00	–	nessus
Tenable Nessus	Debian dla-3629 : ceph - security update	23 Oct 202300:00	–	nessus
Tenable Nessus	Debian dla-4310 : ceph - security update	26 Sep 202500:00	–	nessus
Tenable Nessus	Debian dsa-5825 : ceph - security update	6 Dec 202400:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: ceph (CVE-2023-43040)	3 Jul 202400:00	–	nessus
Tenable Nessus	RHEL 9 : Red Hat Ceph Storage 6.1 (RHSA-2023:5693)	12 Oct 202300:00	–	nessus
Tenable Nessus	RHEL 8 / 9 : Red Hat Ceph Storage 5.3 Security update (Moderate) (RHSA-2024:0745)	9 Feb 202400:00	–	nessus

Vulners

Node

OR

red_hat red_hat_ceph_storageMatch4

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_openshift_container_storageMatch4

red_hat red_hat_ceph_storageMatch5

red_hat red_hat_ceph_storageMatch6.1

canonical ubuntuMatch23.10

Source	Link
groups	www.groups.google.com/g/linux.debian.bugs.dist/c/CEsNRLSLjdk
github	www.github.com/ceph/ceph/pull/53714
github	www.github.com/ceph/ceph/pull/53714/commits/98bfb71cb38899333deb58dd2562037450fd7fa8
packetstormsecurity	www.packetstormsecurity.com/files/cve/CVE-2023-43040/page1/
ubuntu	www.ubuntu.com/security/notices/USN-6613-1
openwall	www.openwall.com/lists/oss-security/2023/09/26/10
docs	www.docs.ceph.com/en/latest/cephadm/services/rgw/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
vuldb	www.vuldb.com/
seclists	www.seclists.org/oss-sec/2023/q3/239

20 Jan 2026 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 36.3

CVSS 26.5

EPSS0.02539

Ceph storage vulnerability get_params flaw bucket keys access arbitrary file upload