Critical Privilege Escalation in RustFS: AddServiceAccount Allows Creation of Root-Parent Service Accounts

Vulnerability Overview Title Critical Privilege Escalation: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts in RustFS Description A comprehensive source code audit of the RustFS project revealed a critical privilege escalation vulnerability located in the Admin API's handler. This handler only verifies whether the caller holds the permission but fails to verify whether the caller is authorized to create a service account for the specified . An attacker with the permission can set to the root account's access key to create a service account whose parent is the system root user. During authentication, the system identifies the root parent and grants this service account full user-level permissions, leading to the takeover of the entire cluster. Vulnerability Description The root cause is improper privilege management (CWE-269): the handler failed to enforce user-level permission boundaries. A complete source-to-sink exploit chain has been verified: 1. Input Source: An authenticated attacker sends an HTTP request to the Admin API endpoint, including a field in the JSON body. 2. Permission Check: The handler only verifies if the caller has the permission. It does not check if the caller has permission to create an account for the . 3. Root User Exemption: When checking if exists, the code explicitly excludes root system credentials: if equals the root access key, the existence check is skipped even if the root user does not exist in the IAM store. 4. Sink Point: The attacker-controlled is passed directly to as the parent user for the new service account. 5. Permission Grant: During service account authentication, detects that the parent user is the root account and sets to . 6. Full Access: When , authorization evaluation allows all operations, granting the service account unrestricted access to the entire system. Code Evidence 1. Handler Entry Point and Attacker-Controlled 2. Insufficient Permission Check 3. Root User Existence Check Exemption 4. Sink: Creating Service Account with Attacker-Controlled Parent 5. Privilege Escalation Finalization: Owner Permission Grant Exploitation Prerequisites 1. The attacker knows the root user's access key (typically configured via environment variables, with the default value being ). 2. The attacker holds existing admin credentials with the permission (e.g., an IAM admin user). 3. The RustFS Admin API (usually port 9000) is accessible to the attacker. Reproduction Steps 1. Using existing admin credentials, send a PUT request to the endpoint, setting to the root access key. 2. The server creates a service account with the root user as its parent and returns the new account's access key and secret key. 3. Authenticate and perform administrative operations (e.g., listing users, modifying system configuration, accessing all buckets) using the newly created service account credentials. 4. Expected Result: All operations succeed, confirming that the service account has acquired owner-level privileges. Proof of Concept Request Impact This vulnerability allows an attacker with limited administrative privileges to escalate to full system owner access, resulting in complete control over the entire cluster: Full read/write access to all bucket and object data across the system. Complete IAM control: creation, deletion, or modification of any users, groups, and permission policies. Complete KMS management: access and management of encryption keys, enabling decryption of encrypted data. Cluster configuration modification: changing cluster settings, enabling/disabling features, and modifying security policies. Cluster operation control: shutting down or restarting services, compromising availability. Remediation Implement the following fixes to close the privilege escalation path: 1. In the handler, when , require the caller to hold elevated impersonation privileges or user management permissions (e.g., ). 2. Restrict cross-user service account creation, allowing only root/owner accounts to create them by default. 3. Move parent user permission validation into the function to enforce checks at a deeper layer and prevent bypass via other call paths.

Goal Reached Thanks to every supporter — we hit 100%!

Critical Privilege Escalation in RustFS: AddServiceAccount Allows Creation of Root-Parent Service Accounts

More from this source