---

Published: June 2024 <br>Author: [YourName]

What is CVE-2023-43040?

In October 2023, a critical vulnerability was discovered in IBM Spectrum Fusion HCI (versions 2.5.2 through 2.7.2). This security flaw, tracked as CVE-2023-43040 (IBM X-Force ID: 266807), centers around how Ceph's RGW (RADOS Gateway) handled access controls for object storage buckets.

Due to *improper bucket access validation*, an attacker could perform actions on buckets they should not have permissions for. In other words, a bug lets attackers bypass some security checks and do things like read, write, or delete data in buckets owned by other users.

If you use IBM Spectrum Fusion HCI and haven’t patched yet—read on.

How Does It Work?

Ceph RGW provides S3-compatible object storage. Normally, when a user makes an API call (like GET or PUT) to a bucket, RGW checks whether that user is allowed to do so. This vulnerability is about that check not being strict or complete enough.

The Core Issue

> *IBM Spectrum Fusion HCI did not correctly confirm user permissions when requests were made for bucket access in Ceph RGW. This gap could be abused to gain unauthorized access.*

Delete critical objects, causing data loss

This could be done without needing valid permissions, just by crafting specific API requests.

Below is a simple proof-of-concept using curl to demonstrate a bucket listing attempt

# Replace <target-IP>, <unauthorized-bucket> and relevant tokens as needed

curl -X GET \
  "https://<target-IP>/ceph/rgw/<unauthorized-bucket>/?list-type=2"; \
  -H "Host: example.ceph.com" \
  -H "Authorization: AWS <access_key>:<signature>"

The attacker uses credentials for their own account but targets someone else’s bucket.

- Due to the flaw, RGW may *not* block the attacker and might return a full listing of the victim’s bucket.

Here’s how an access policy might look misconfigured or bypassed

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BadPolicy",
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

If RGW fails to enforce bucket ownership, this problem allows the attacker to interact with *any* bucket using crafted calls.

Data Theft: Sensitive company data could be stolen.

- Ransomware: Malicious actors could upload thousands of files or overwrite existing ones as part of a ransomware campaign.

IBM Security Bulletin (Original Advisory):

https://www.ibm.com/support/pages/node/7040154

IBM X-Force Exchange Entry:

https://exchange.xforce.ibmcloud.com/vulnerabilities/266807

Update Immediately:

IBM Spectrum Fusion HCI 2.5.2 - 2.7.2 users must upgrade to a patched release as soon as possible.

Final Thoughts

CVE-2023-43040 is an important reminder that access controls must be tested continuously. Even trusted enterprise systems from companies like IBM can have missteps.

If you’re using IBM Spectrum Fusion HCI, act now. Upgrade, audit, and monitor.


References:
IBM Security Bulletin: https://www.ibm.com/support/pages/node/7040154
IBM X-Force: https://exchange.xforce.ibmcloud.com/vulnerabilities/266807

Timeline

Published on: 05/14/2024 13:46:23 UTC
Last modified on: 05/14/2024 16:13:02 UTC