CVE-2020-10753 in Ceph Storage RadosGW
Summary
by MITRE
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/24/2026
The vulnerability identified as CVE-2020-10753 represents a critical header injection flaw within the Red Hat Ceph Storage RadosGW component, specifically affecting the Cross-Origin Resource Sharing implementation. This issue stems from inadequate input validation in the CORS configuration handling mechanism, where the system fails to properly sanitize user-supplied data before incorporating it into HTTP response headers. The flaw manifests when the ExposeHeader parameter within the CORS configuration contains newline characters, which are then interpreted by the HTTP response parser as legitimate header terminators rather than malicious payload elements. This vulnerability affects Ceph storage systems running versions 3.x and 4.x, making a significant portion of the Ceph ecosystem susceptible to exploitation.
The technical exploitation of this vulnerability occurs through the manipulation of CORS configuration files where an attacker can inject malicious HTTP headers by embedding newline characters within the ExposeHeader tag. When a CORS request is processed, the system constructs HTTP responses that include these improperly sanitized headers, allowing for header injection attacks that can potentially redirect traffic, manipulate response content, or enable further exploitation vectors. This type of vulnerability falls under the CWE-113 category, which specifically addresses improper neutralization of CRLF (Carriage Return Line Feed) sequences in HTTP headers, making it a direct descendant of well-known header injection attack patterns. The implementation flaw occurs at the application layer where HTTP response construction does not adequately validate or escape user-provided header values before concatenating them into the final response structure.
The operational impact of this vulnerability extends beyond simple header injection, as it can enable attackers to perform various malicious activities including but not limited to cache poisoning, response splitting, and potentially more sophisticated attacks depending on the specific implementation details of the affected systems. An attacker who can control the CORS configuration or has access to modify configuration files could inject malicious headers that alter the behavior of web applications consuming the Ceph storage service. This vulnerability particularly impacts organizations relying on Ceph for object storage solutions where CORS policies are implemented to control cross-origin access, potentially exposing sensitive data or enabling unauthorized access to storage resources. The attack surface is amplified when considering that many cloud and enterprise environments utilize Ceph as a backend storage solution, making this vulnerability a significant concern for organizations maintaining distributed storage infrastructures.
Organizations affected by CVE-2020-10753 should implement immediate mitigations including thorough input validation of all CORS configuration parameters, particularly those related to ExposeHeader tags, and ensure that newline characters are properly escaped or removed from user-supplied data before processing. The recommended approach involves implementing strict sanitization routines that filter or encode special characters within header configuration values, with particular attention to carriage return and line feed sequences. Additionally, system administrators should review and audit existing CORS configurations to identify any potentially malicious or malformed header entries. According to ATT&CK framework, this vulnerability maps to T1190 - Exploit Public-Facing Application, as it represents an attack vector through publicly accessible storage gateway services. Organizations should also consider implementing network segmentation and access controls to limit exposure of the affected RadosGW components and monitor for suspicious configuration changes or unauthorized modifications to CORS policies that could indicate exploitation attempts.