Ceph RadosGW JWT Authentication Bypass (CVE-2024-48916): Brief Summary and Patch Overview

Introduction

Unauthorized access to distributed storage can expose sensitive data to attackers and undermine the integrity of the infrastructure built on it. CVE-2024-48916, a recent authentication bypass in Ceph RadosGW, shows how one oversight in token validation can have far-reaching consequences for organizations that run object storage at scale.

Ceph is a widely used open-source distributed storage platform that provides object, block, and file storage for cloud and enterprise environments. Its Rados Gateway (RadosGW) component provides S3-compatible RESTful access and is often integrated with OpenID Connect (OIDC) for authentication. Ceph is central to many cloud deployments, and thousands of organizations and service providers depend on its reliability and security.

Technical Information

CVE-2024-48916 comes from insufficient validation of JSON Web Token (JWT) algorithms in the RadosGW OIDC provider. When a JWT arrives with the alg field set to none, the system does not enforce signature verification. An attacker can craft a JWT with alg=none and arbitrary claims, and RadosGW will accept it as valid, bypassing authentication entirely.

The root cause is that RadosGW did not restrict JWT algorithms to a secure, supported set. Tokens with alg=none passed straight through, which switched off the cryptographic checks. Any Ceph deployment using RadosGW with OIDC authentication is open to unauthorized access if an attacker can submit a crafted JWT.

The referenced materials include no public code snippets or exploit samples, but the advisory and patch notes make the mechanism clear.

Patch Information

The vulnerability in the Ceph RadosGW (RGW) component came from unsupported JSON Web Token (JWT) algorithms not being properly restricted. Attackers could use those unsupported algorithms to bypass authentication.

The patch explicitly disallows any JWT algorithm that RGW does not support. At its center is a change to the rgw/sts module that enforces strict validation of JWT algorithms during authentication.

Changes in the patch include:

• The system checks the algorithm named in the JWT header against a list of supported algorithms. If the algorithm is not recognized or not supported, authentication stops and access is denied.
• When the system detects an unsupported algorithm, it logs a detailed error message naming the algorithm and the reason for the authentication failure. This helps with troubleshooting and tells administrators about potential misuse attempts.
• A new function extracts the algorithm from the JWT header and compares it against the supported algorithms. On a mismatch, the function returns an error and the token is not processed further.

This simplified snippet shows the core logic of the patch:

std::string algorithm = extract_algorithm_from_jwt(jwt_header);
if (!is_supported_algorithm(algorithm)) {
    ldout(cct, 0) << "Unsupported JWT algorithm: " << algorithm << dendl;
    return -ERR_INVALID_TOKEN;
}

In this code:

• extract_algorithm_from_jwt parses the JWT header to get the algorithm used.
• is_supported_algorithm checks whether the extracted algorithm is in the list of algorithms RGW supports.
• If the algorithm is unsupported, the code logs an error message and returns an error code, which denies access.

With the patch, RGW accepts only tokens signed with approved algorithms, which reduces the risk of authentication bypass through unsupported JWT algorithms.

For more details on the patch, see the official GitHub pull request: https://github.com/ceph/ceph/pull/60624

Detection Methods

Detecting exploitation of vulnerabilities like CVE-2024-41228 in AliyunContainerService Pouch 1.3.1 calls for both static and dynamic analysis.

Static Analysis

Manual source code review:

• Targeted spot checks of the code that handles file operations, looking for improper handling of symbolic links.
• A full review of the codebase for vulnerabilities related to symlink handling.

Automated static analysis:

• Source code weakness analyzers that scan for known vulnerability patterns, including improper symlink handling.
• Analyzers configured for the application's specific context, to catch subtler issues.

Dynamic Analysis

Automated testing:

• Web application and service scanners run against the application at runtime, to find vulnerabilities that appear during execution.
• Database scanners, to check that database interactions are not open to symlink-related exploits.

Manual testing:

• Fuzz testing of input fields and file operations, to find unexpected behavior or crashes that point to vulnerabilities.
• Fuzzing frameworks tailored to the application's architecture, for more effective testing.

Architecture and Design Review

• Formal methods: formal verification that mathematically proves the application handles file operations correctly.
• Inspection: systematic inspection of the application's design and implementation to find and mitigate potential symlink vulnerabilities.

For more details on detection, see: https://vuldb.com/?id.278291

Affected Systems and Versions

CVE-2024-48916 affects these Ceph versions and distributions:

• Ceph versions up to and including 16.2.14+ds-0 (Debian bookworm)
• Ceph versions up to and including 18.2.3+ds-10 (Debian sid/trixie)
• Ceph versions up to and including 19.2.3 (upstream)
• Ceph versions up to and including 17.2.6-0ubuntu0.22.04.1 (Ubuntu 22.04 LTS)
• Ceph versions up to and including 19.2.0-54.el9cp (Red Hat)

Any deployment in these versions that uses RadosGW with OIDC authentication is vulnerable.

Vendor Security History

Ceph has had earlier authentication-related vulnerabilities, including CVE-2023-43040, which also affected RadosGW. The vendor has a pattern of fixing such issues promptly, with patches released across major distributions within weeks of disclosure. The project's transparent advisories and active engagement with the open-source community reflect its security maturity.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-48916
• https://www.cve.org/CVERecord?id=CVE-2024-48916
• https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq
• https://github.com/ceph/ceph/pull/60624
• https://security-tracker.debian.org/tracker/CVE-2024-48916
• https://ubuntu.com/security/CVE-2024-48916
• https://access.redhat.com/security/cve/cve-2024-48916
• https://osv.dev/vulnerability/RHSA-2024:10956
• https://www.debian.org/security/2024/dsa-5825
• https://security-tracker.debian.org/tracker/DSA-5825-1
• https://explore.alas.aws.amazon.com/CVE-2024-48916.html
• https://www.tenable.com/cve/CVE-2024-48916
• https://app.opencve.io/cve/CVE-2024-48916
• https://linuxsecurity.com/advisories/mageia/mageia-2025-0011-ceph-security-advisory-updates-qde73eraacsg
• https://www.suse.com/security/cve/CVE-2024-48916.html
• https://rapid7.com/db/vulnerabilities/ubuntu-cve-2024-48916/
• https://vuldb.com/?id.278291