Description (CNA)
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenStack / Swift | affected 2.4.0 before 2.35.5; affected 2.36.0 before 2.36.4; affected 2.37.0 before 2.37.4; affected 2.38.0 before 2.38.2 |
CWE
CWE-184
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.