RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.
Weakness
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rustfs | Rustfs | 1.0.0-alpha1 (including) | 1.0.0-alpha1 (including) |
| Rustfs | Rustfs | 1.0.0-alpha10 (including) | 1.0.0-alpha10 (including) |
| Rustfs | Rustfs | 1.0.0-alpha11 (including) | 1.0.0-alpha11 (including) |
| Rustfs | Rustfs | 1.0.0-alpha12 (including) | 1.0.0-alpha12 (including) |
| Rustfs | Rustfs | 1.0.0-alpha13 (including) | 1.0.0-alpha13 (including) |
| Rustfs | Rustfs | 1.0.0-alpha14 (including) | 1.0.0-alpha14 (including) |
| Rustfs | Rustfs | 1.0.0-alpha15 (including) | 1.0.0-alpha15 (including) |
| Rustfs | Rustfs | 1.0.0-alpha16 (including) | 1.0.0-alpha16 (including) |
| Rustfs | Rustfs | 1.0.0-alpha17 (including) | 1.0.0-alpha17 (including) |
| Rustfs | Rustfs | 1.0.0-alpha18 (including) | 1.0.0-alpha18 (including) |
| Rustfs | Rustfs | 1.0.0-alpha19 (including) | 1.0.0-alpha19 (including) |
| Rustfs | Rustfs | 1.0.0-alpha2 (including) | 1.0.0-alpha2 (including) |
| Rustfs | Rustfs | 1.0.0-alpha20 (including) | 1.0.0-alpha20 (including) |
| Rustfs | Rustfs | 1.0.0-alpha21 (including) | 1.0.0-alpha21 (including) |
| Rustfs | Rustfs | 1.0.0-alpha22 (including) | 1.0.0-alpha22 (including) |
| Rustfs | Rustfs | 1.0.0-alpha23 (including) | 1.0.0-alpha23 (including) |
| Rustfs | Rustfs | 1.0.0-alpha24 (including) | 1.0.0-alpha24 (including) |
| Rustfs | Rustfs | 1.0.0-alpha25 (including) | 1.0.0-alpha25 (including) |
| Rustfs | Rustfs | 1.0.0-alpha26 (including) | 1.0.0-alpha26 (including) |
| Rustfs | Rustfs | 1.0.0-alpha27 (including) | 1.0.0-alpha27 (including) |
| Rustfs | Rustfs | 1.0.0-alpha28 (including) | 1.0.0-alpha28 (including) |
| Rustfs | Rustfs | 1.0.0-alpha29 (including) | 1.0.0-alpha29 (including) |
| Rustfs | Rustfs | 1.0.0-alpha3 (including) | 1.0.0-alpha3 (including) |
| Rustfs | Rustfs | 1.0.0-alpha30 (including) | 1.0.0-alpha30 (including) |
| Rustfs | Rustfs | 1.0.0-alpha31 (including) | 1.0.0-alpha31 (including) |
| Rustfs | Rustfs | 1.0.0-alpha32 (including) | 1.0.0-alpha32 (including) |
| Rustfs | Rustfs | 1.0.0-alpha33 (including) | 1.0.0-alpha33 (including) |
| Rustfs | Rustfs | 1.0.0-alpha34 (including) | 1.0.0-alpha34 (including) |
| Rustfs | Rustfs | 1.0.0-alpha35 (including) | 1.0.0-alpha35 (including) |
| Rustfs | Rustfs | 1.0.0-alpha36 (including) | 1.0.0-alpha36 (including) |
| Rustfs | Rustfs | 1.0.0-alpha37 (including) | 1.0.0-alpha37 (including) |
| Rustfs | Rustfs | 1.0.0-alpha38 (including) | 1.0.0-alpha38 (including) |
| Rustfs | Rustfs | 1.0.0-alpha39 (including) | 1.0.0-alpha39 (including) |
| Rustfs | Rustfs | 1.0.0-alpha4 (including) | 1.0.0-alpha4 (including) |
| Rustfs | Rustfs | 1.0.0-alpha40 (including) | 1.0.0-alpha40 (including) |
| Rustfs | Rustfs | 1.0.0-alpha41 (including) | 1.0.0-alpha41 (including) |
| Rustfs | Rustfs | 1.0.0-alpha42 (including) | 1.0.0-alpha42 (including) |
| Rustfs | Rustfs | 1.0.0-alpha43 (including) | 1.0.0-alpha43 (including) |
| Rustfs | Rustfs | 1.0.0-alpha44 (including) | 1.0.0-alpha44 (including) |
| Rustfs | Rustfs | 1.0.0-alpha45 (including) | 1.0.0-alpha45 (including) |
| Rustfs | Rustfs | 1.0.0-alpha46 (including) | 1.0.0-alpha46 (including) |
| Rustfs | Rustfs | 1.0.0-alpha47 (including) | 1.0.0-alpha47 (including) |
| Rustfs | Rustfs | 1.0.0-alpha48 (including) | 1.0.0-alpha48 (including) |
| Rustfs | Rustfs | 1.0.0-alpha49 (including) | 1.0.0-alpha49 (including) |
| Rustfs | Rustfs | 1.0.0-alpha5 (including) | 1.0.0-alpha5 (including) |
| Rustfs | Rustfs | 1.0.0-alpha50 (including) | 1.0.0-alpha50 (including) |
| Rustfs | Rustfs | 1.0.0-alpha51 (including) | 1.0.0-alpha51 (including) |
| Rustfs | Rustfs | 1.0.0-alpha52 (including) | 1.0.0-alpha52 (including) |
| Rustfs | Rustfs | 1.0.0-alpha53 (including) | 1.0.0-alpha53 (including) |
| Rustfs | Rustfs | 1.0.0-alpha54 (including) | 1.0.0-alpha54 (including) |
| Rustfs | Rustfs | 1.0.0-alpha55 (including) | 1.0.0-alpha55 (including) |
| Rustfs | Rustfs | 1.0.0-alpha56 (including) | 1.0.0-alpha56 (including) |
| Rustfs | Rustfs | 1.0.0-alpha57 (including) | 1.0.0-alpha57 (including) |
| Rustfs | Rustfs | 1.0.0-alpha58 (including) | 1.0.0-alpha58 (including) |
| Rustfs | Rustfs | 1.0.0-alpha59 (including) | 1.0.0-alpha59 (including) |
| Rustfs | Rustfs | 1.0.0-alpha6 (including) | 1.0.0-alpha6 (including) |
| Rustfs | Rustfs | 1.0.0-alpha60 (including) | 1.0.0-alpha60 (including) |
| Rustfs | Rustfs | 1.0.0-alpha61 (including) | 1.0.0-alpha61 (including) |
| Rustfs | Rustfs | 1.0.0-alpha62 (including) | 1.0.0-alpha62 (including) |
| Rustfs | Rustfs | 1.0.0-alpha63 (including) | 1.0.0-alpha63 (including) |
| Rustfs | Rustfs | 1.0.0-alpha64 (including) | 1.0.0-alpha64 (including) |
| Rustfs | Rustfs | 1.0.0-alpha65 (including) | 1.0.0-alpha65 (including) |
| Rustfs | Rustfs | 1.0.0-alpha66 (including) | 1.0.0-alpha66 (including) |
| Rustfs | Rustfs | 1.0.0-alpha67 (including) | 1.0.0-alpha67 (including) |
| Rustfs | Rustfs | 1.0.0-alpha68 (including) | 1.0.0-alpha68 (including) |
| Rustfs | Rustfs | 1.0.0-alpha69 (including) | 1.0.0-alpha69 (including) |
| Rustfs | Rustfs | 1.0.0-alpha7 (including) | 1.0.0-alpha7 (including) |
| Rustfs | Rustfs | 1.0.0-alpha70 (including) | 1.0.0-alpha70 (including) |
| Rustfs | Rustfs | 1.0.0-alpha71 (including) | 1.0.0-alpha71 (including) |
| Rustfs | Rustfs | 1.0.0-alpha72 (including) | 1.0.0-alpha72 (including) |
| Rustfs | Rustfs | 1.0.0-alpha73 (including) | 1.0.0-alpha73 (including) |
| Rustfs | Rustfs | 1.0.0-alpha74 (including) | 1.0.0-alpha74 (including) |
| Rustfs | Rustfs | 1.0.0-alpha75 (including) | 1.0.0-alpha75 (including) |
| Rustfs | Rustfs | 1.0.0-alpha76 (including) | 1.0.0-alpha76 (including) |
| Rustfs | Rustfs | 1.0.0-alpha77 (including) | 1.0.0-alpha77 (including) |
| Rustfs | Rustfs | 1.0.0-alpha8 (including) | 1.0.0-alpha8 (including) |
| Rustfs | Rustfs | 1.0.0-alpha9 (including) | 1.0.0-alpha9 (including) |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/21.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/459.html
- https://cwe.mitre.org/data/definitions/461.html
- https://cwe.mitre.org/data/definitions/473.html
- https://cwe.mitre.org/data/definitions/476.html
- https://cwe.mitre.org/data/definitions/59.html
- https://cwe.mitre.org/data/definitions/60.html
- https://cwe.mitre.org/data/definitions/667.html
- https://cwe.mitre.org/data/definitions/94.html