Executive brief
NooBaa Multicloud Object Gateway is a cloud storage service that processes S3 upload requests using cryptographic signatures to verify authenticity. A flaw in the signature validation logic allows an attacker with a valid presigned upload URL to add unsigned headers that alter the operation, enabling them to copy arbitrary data across the storage system instead of just uploading a file. This could result in unauthorized data access and modification.
Technical details
The vulnerability resides in noobaa-core's S3 Signature Version 4 (SigV4) verification logic, which fails to reject requests containing unsigned x-amz- headers and instead drops them from signature calculations. An attacker who possesses a valid presigned PUT URL can inject an unsigned x-amz-copy-source header, converting the operation to a CopyObject, granting access to any data the original signer can reach. The attack requires network access and a valid presigned URL (low privilege requirement), with no user interaction needed.
Affected products
- IBM NooBaa Multicloud Object Gateway
Timeline
- 2026-09-21: disclosed