CVE-2015-5223

What it actually does

Allows unauthenticated remote attackers to read object contents from a different container by crafting a temporary URL that references a Dynamic Large Object manifest crossing container boundaries.

Why it matters to the business

Exposure of sensitive stored objects can lead to data leaks, regulatory penalties, and loss of customer trust in object storage deployments.

How an attack unfolds

An attacker obtains a valid temporary URL via a PUT operation, then supplies a DLO manifest that points to an object residing in a separate container; the server follows the manifest without enforcing container isolation, returning the target object's data.

How to fix it

Upgrade OpenStack Swift to version 2.4.0 or later; enforce strict container isolation policies and review all existing temporary URL grants for cross-container manifests.

How to confirm the fix worked

Confirm Swift version is 2.4.0 or newer; test that manifests referencing other containers are rejected and review audit logs for any prior cross-container manifest usage.

Typical attack path

1. Discover or obtain a temporary URL endpoint for an authorized container
2. Create or modify a DLO manifest that references an object in a different container
3. Issue a GET request using the temporary URL against the manifest
4. Receive unauthorized object contents from the cross-container reference

How to detect it

Review Swift proxy and object server logs for PUT and GET operations involving tempurls combined with manifests; search for manifest paths that reference containers different from the one the temporary URL was issued against.

What your security team should do

• Immediately inventory all Swift deployments and schedule upgrades to 2.4.0+
• Scan object manifests for cross-container references and revoke affected temporary URLs
• Enable detailed logging of manifest operations and temporary URL usage for ongoing monitoring