RustFS Multiple Privilege Escalation and Information Disclosure Vulnerabilities (GHSA)

Vulnerability Overview The screenshot displays a document titled “advisory-patterns.md” regarding security vulnerabilities. The document lists multiple security vulnerabilities along with related information, including vulnerability IDs, descriptions, scope of impact, and remediation measures. Scope of Impact 1. GHSA-pfqc-6j3r-6gjm - Description: The notification target endpoint accepted authenticated users but skipped administrator authorization. - Impact: Any authenticated user can access the notification target endpoint without administrator authorization. 2. GHSA-m2qy-qcxs-gw4v - Description: utilized , while the update lacked a target ownership check. - Impact: Any authenticated user can update the administrator actions for a service account without a target ownership check. 3. GHSA-wcwh-pf99-64cc - Description: checked the Import/Write operations for . - Impact: Any authenticated user can perform Import/Write operations without additional permission checks. 4. GHSA-jpmc-m333-v45g - Description: The and endpoints in were excluded from , allowing unauthorized access. - Impact: Unauthenticated users can access the and endpoints. 5. GHSA-f9cv-4ca4-2zp7 - Description: accepted any authenticated IAM user and skipped administrator authorization. - Impact: Any authenticated IAM user can access the endpoint without administrator authorization. 6. GHSA-7f6f-j7xp-hw4f - Description: only checked for the existence of credentials and leaked replication information. - Impact: Any authenticated user can access the endpoint and leak replication information. 7. GHSA-xp32-gxq2-3v62 - Description: The console license metadata endpoint is public and exposes the subject and expiration fields. - Impact: Unauthenticated users can access the console license metadata endpoint and obtain the subject and expiration fields. 8. GHSA-666f-q82r-wcr8 - Description: ImportIAM accepted attacker-controlled service account , , , and . - Impact: Attackers can control the service account's , , , and . 9. GHSA-3495-h89z-gfqp - Description: ExportIAM writes normal user and service account keys into the exported ZIP data. - Impact: The exported ZIP data contains normal user and service account keys. 10. GHSA-5354-r3u3-34e8 - Description: AddServiceAccount checked but trusted the caller-provided target. - Impact: The caller can provide an arbitrary target without additional permission checks. 11. GHSA-vgf5-qxw2-wgp8 - Description: skipped allowance checks and restricted service accounts to unrestricted sub-accounts. - Impact: Service accounts can access sub-accounts without restriction. 12. GHSA-m2qy-qcxs-gw4v - Description: Leaked service account access keys combined with ownership updates on updates formed an escalation chain. - Impact: Leaked service account access keys can be used for further privilege escalation. 13. GHSA-5qfp-nf7r-jc9w - Description: in is reachable via unauthenticated POST requests. - Impact: Unauthenticated users can access via POST requests. 14. GHSA-jrrr-rfqc-h858 - Description: Unsigned JWT issuer data was decoded before validation to select the OIDC provider, distinguishing between , , and . - Impact: Unsigned JWT issuer data can be tampered with to select an OIDC provider. 15. GHSA-9yjf-v0c2-k237 - Description: Public OIDC authorization/callback flows in and trusted requests. - Impact: Public OIDC authorization/callback flows trusted requests, potentially leading to privilege escalation. 16. GHSA-n479-9x85-94a4 - Description: OIDC verification in , , and accepted requests. - Impact: OIDC verification accepted requests, potentially leading to privilege escalation. 17. GHSA-6r96-m6qc-726c - Description: Request headers conflicted with lower-case server-derived condition keys, such as and . - Impact: Request headers conflicted with server-derived condition keys, potentially leading to privilege escalation. Remediation 1. GHSA-pfqc-6j3r-6gjm - Remediation: Ensure that the notification target endpoint requires administrator authorization. 2. GHSA-m2qy-qcxs-gw4v - Remediation: Add a target ownership check when updating administrator actions for service accounts. 3. GHSA-wcwh-pf99-64cc - Remediation: Add additional permission checks in the operation. 4. GHSA-jpmc-m333-v45g - Remediation: Re-integrate the and endpoints into the scope. 5. GHSA-f9cv-4ca4-2zp7 - Remediation: Add an administrator authorization check in the endpoint. 6. GHSA-7f6f-j7xp-hw4f - Remediation: Add comprehensive permission checks in the endpoint and hide replication information. 7. GHSA-xp32-gxq2-3v62 - Remediation: Set the console license metadata endpoint to private and hide the subject and expiration fields. 8. GHSA-666f-q82r-wcr8 - Remediation: Validate the service account's , , , and in the ImportIAM operation. 9. GHSA-3495-h89z-gfqp - Remediation: Do not export normal user and service account keys in the ExportIAM operation. 10. GHSA-5354-r3u3-34e8 - Remediation: Validate the caller-provided target in the AddServiceAccount operation. 11. GHSA-

Goal Reached Thanks to every supporter — we hit 100%!

RustFS Multiple Privilege Escalation and Information Disclosure Vulnerabilities (GHSA)

More from this source