Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in the Ceph distributed storage platform, which could allow unauthorized access to sensitive configuration secrets, including disk encryption passphrases and administrative SSH keys. This exposure could potentially lead to a full compromise of both the storage cluster and its underlying host systems.
- Low-privilege users can read sensitive secrets.
- A compromised key grants root access to all hosts.
- Confirm relevance and exposure within your Ceph environment.
Attack Path
How an attacker could exploit the issue
An attacker with limited read-only access to the Ceph cluster can exploit this vulnerability by sending a specially crafted message to the Monitor component. This allows them to bypass authorization checks and access sensitive information stored in the configuration-key store. This could lead to a full compromise of the cluster and its hosts.
- Requires unauthenticated network access.
- Triggered by sending a crafted `MMonSubscribe` message.
- Enables unauthorized access to secrets and host keys.
Live Threat
Current exploitation, exposure, and threat context
A low-privileged user with read-only access to Ceph could potentially access sensitive secrets stored in the configuration-key store. This could occur when a crafted message is sent to the Monitor subscription handler, which may not properly authorize access to this store under specific conditions. The affected secrets include OSD LUKS disk-encryption passphrases and, in clusters managed by cephadm, the SSH private key used by cephadm to access all hosts.
- Encrypted disk passphrases and cluster SSH key.
- Unauthorized Monitor subscription message.
- Full cluster and host compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
Real-world action for this critical vulnerability falls to the platform or infrastructure teams responsible for the Ceph distributed storage system, in coordination with the security team. The immediate priority is to inventory all Ceph deployments, determine their exposure to unauthorized access, and confirm if they hold sensitive data or provide critical services. Once identified and prioritized, a plan for remediation, which may involve vendor coordination for updates or implementing compensating controls, should be developed and executed.
- Platform/Infrastructure teams own the remediation.
- Verify exposed Ceph monitor endpoints.
- Plan for updates or risk mitigation.
