CVE-2021-3524: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2021-3524) was discovered in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. When a CORS request is made, the newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response. This issue is particularly notable as it builds upon a previous vulnerability (CVE-2020-10753), where the prior fix did not account for the use of \r as a header separator (NVD, Debian LTS).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-20 (Improper Input Validation). The vulnerability specifically involves the manipulation of HTTP headers through CORS ExposeHeader tags, where both newline characters and \r can be used as header separators to inject malicious headers (NVD).

The vulnerability allows attackers to inject arbitrary HTTP headers into responses when CORS requests are made. For example, malicious users could create a publicly-accessible S3 bucket with such CORS configuration, and anyone accessing that bucket would have these headers injected. This could lead to the injection of arbitrary headers such as Set-Cookie to set unauthorized cookies (Red Hat Bugzilla).

The vulnerability can be exploited when a malicious user creates a publicly-accessible S3 bucket with specially crafted CORS configuration. The attack vector requires the ability to configure CORS settings on a bucket, and the exploitation occurs when other users access the affected bucket (Red Hat Bugzilla).

The vulnerability has been fixed in Ceph version 14.2.21 and later releases. Various distributions have released security updates to address this issue, including Red Hat Ceph Storage, Debian, and Fedora. Users are advised to upgrade to the fixed versions: Fedora 32 (14.2.21-1.fc32), Fedora 33 (15.2.12-1.fc33), Fedora 34 (16.2.4-1.fc34), and Debian 9 (10.2.11-2+deb9u1) (Fedora Update, Debian LTS).