A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3_acl=true (non-default), the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account, X-Symlink-Target, X-Symlink-Target-Account, X-Object-Manifest, X-Static-Large-Object) from incoming S3 API requests. When s3_acl=true, the S3AclRequest class sets swift.authorize_override=True, bypassing Swift's native authorization. Since the S3 ACL system does not understand these native Swift headers, an authenticated attacker can inject X-Copy-From and X-Copy-From-Account headers to copy objects from other tenants' storage into their own account. The attacker must know the target project_id, container name, and object name.

The vulnerability is in S3AclRequest.to_swift_req() (s3request.py) which disables native Swift auth, combined with S3Request.__init__() not stripping native Swift control headers from incoming requests.

Affected versions: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3
Fix commit: 0e4a334aa41980b0ae0c7f2244ddfa8c3c24e5db

Reporter: Christian Schwede (NVIDIA), reported via OpenStack VMT
PSIRT Ticket: PSIRTSUPT-19763
Upstream private report: https://launchpad.net/bugs/2158733