A security issue was discovered in Reva that enables a malicious user to bypass the scope validation of a public link. That allows it to access resources outside the scope of a public link.
OpenCloud uses Reva as one of its core components and thus it is affected.
Update to OpenCloud version >= 4.0.3 (stable release) Update to OpenCloud version >= 5.0.2 (rolling release)
If projects are unable to update immediately, please implement the following security configuration to disable public link shares temporarily until the final solution for this problem is rolled out.
GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT=“” (empty string value) in the environment section of the opencloud container.Execute the following test:
This configuration provides immediate protection and should be implemented immediately. Configuration mitigation is available. It mitigates the problem completely.
If there are questions or comments about this advisory:
4.0.35.0.2Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:HI:LA:N8.2/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N