RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90.

N/A

授权机制缺失

rustfs 安全漏洞

rustfs是RustFS开源的一个高性能对象存储系统。 RustFS alpha.90之前版本存在安全漏洞，该漏洞源于多部分复制路径中缺少授权检查，可能导致低权限用户突破租户隔离。

N/A

N/A