The vulnerability in noobaa-core arises from improper validation of x-amz- headers in SigV4 presigned URL requests. Specifically, the service fails to reject requests containing unsigned x-amz- headers, dropping them from the signature calculation instead. This allows an attacker possessing a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively escalating the operation to CopyObject. This flaw enables unauthorized copying of any data the original signer can access across the storage system. The root cause is the failure to enforce inclusion of all x-amz- headers in the cryptographic signature, violating proper signature verification principles. The vulnerability is rated important/high severity by Red Hat with a CVSS 3.1 score of 7.1 (Network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, no availability impact).

Successful exploitation allows an attacker with a valid presigned URL to bypass intended access controls and read or overwrite any data accessible to the signer of the URL. This can lead to unauthorized data copying across the entire storage system managed by Red Hat Openshift Data Foundation 4. The confidentiality impact is high, integrity impact is low, and availability is unaffected.

Red Hat manages remediation for this cloud-hosted service and has confirmed that a patch is available. However, currently available mitigations do not meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates and apply the official fix once released. No alternative mitigations are recommended by Red Hat at this time.