CVE-2020-10753: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) related to HTTP header injection via CORS ExposeHeader tags. The flaw allows injection of HTTP headers when a newline character is present in the ExposeHeader tag within the CORS configuration file, which generates a header injection in the response when a CORS request is made. This vulnerability affects Ceph versions 3.x and 4.x (NVD, Red Hat Bugzilla).

The vulnerability has a CVSS v3.1 Base Score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The issue specifically involves the CORS (Cross-Origin Resource Sharing) configuration where a malicious user could create a publicly-accessible S3 bucket with crafted CORS configuration. When the CORS request is made, the response contains the injected header, allowing attackers to add arbitrary headers such as Set-Cookie to set arbitrary cookies (Red Hat Bugzilla).

The vulnerability enables attackers to perform HTTP header injection attacks through manipulated CORS configurations. For example, a malicious user could create a publicly-accessible S3 bucket with such CORS configuration, and anyone accessing that bucket would have these headers injected. This could lead to setting arbitrary cookies and potentially affecting user sessions (Red Hat Bugzilla).

The vulnerability requires an attacker to create a specially crafted CORS configuration in an S3 bucket. The exploit can be triggered when users access the affected bucket, making it particularly concerning for publicly accessible buckets. The vulnerability has been confirmed to affect the RHCS RadosGW S3 API, though it does not affect the Swift API (Ubuntu Security).

The vulnerability has been fixed in multiple versions across different distributions: Ceph version 14.2.10 for Fedora, version 12.2.13-0ubuntu0.18.04.4 for Ubuntu 18.04 LTS, and version 10.2.11-0ubuntu0.16.04.3 for Ubuntu 16.04 LTS. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Ubuntu Security, Fedora Update).