CVE-2023-43040

What it actually does

The flaw permits unauthorized actions against Ceph RGW buckets because of missing or bypassed authorization checks on bucket access requests.

Why it matters to the business

Attackers can alter or delete stored objects without permission, risking data integrity, compliance violations, and operational disruption in storage environments.

How an attack unfolds

An unauthenticated or low-privileged attacker sends specially crafted requests to an exposed RGW endpoint; the missing access validation allows the request to succeed, enabling modification or deletion of objects in buckets the attacker should not control.

How to fix it

Upgrade IBM Spectrum Fusion HCI to a release after 2.7.2 that restores proper Ceph RGW bucket authorization enforcement; restrict network exposure of RGW endpoints until patched.

How to confirm the fix worked

After applying the update, confirm that previously allowed unauthorized bucket operations now return authorization errors; review Ceph RGW access logs for policy enforcement.

Typical attack path

1. Locate publicly reachable RGW service endpoints
2. Send bucket or object requests with manipulated authorization headers or paths
3. Bypass the flawed access check to perform write or delete operations
4. Persist changes or exfiltrate data as needed

How to detect it

Review Ceph RGW access and audit logs for successful operations on buckets where the requester lacks documented permissions; correlate with network logs showing unexpected connections to RGW ports.

What your security team should do

• Prioritize patching all affected Spectrum Fusion HCI deployments
• Temporarily block or tightly ACL inbound traffic to RGW services
• Audit existing bucket policies and enable detailed RGW auditing
• Monitor EPSS trend and any new exploit publications for increased urgency