RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed deny_only short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rustfs | Rustfs | 1.0.0-alpha13 (including) | 1.0.0-alpha13 (including) |
| Rustfs | Rustfs | 1.0.0-alpha14 (including) | 1.0.0-alpha14 (including) |
| Rustfs | Rustfs | 1.0.0-alpha15 (including) | 1.0.0-alpha15 (including) |
| Rustfs | Rustfs | 1.0.0-alpha16 (including) | 1.0.0-alpha16 (including) |
| Rustfs | Rustfs | 1.0.0-alpha17 (including) | 1.0.0-alpha17 (including) |
| Rustfs | Rustfs | 1.0.0-alpha18 (including) | 1.0.0-alpha18 (including) |
| Rustfs | Rustfs | 1.0.0-alpha19 (including) | 1.0.0-alpha19 (including) |
| Rustfs | Rustfs | 1.0.0-alpha20 (including) | 1.0.0-alpha20 (including) |
| Rustfs | Rustfs | 1.0.0-alpha21 (including) | 1.0.0-alpha21 (including) |
| Rustfs | Rustfs | 1.0.0-alpha22 (including) | 1.0.0-alpha22 (including) |
| Rustfs | Rustfs | 1.0.0-alpha23 (including) | 1.0.0-alpha23 (including) |
| Rustfs | Rustfs | 1.0.0-alpha24 (including) | 1.0.0-alpha24 (including) |
| Rustfs | Rustfs | 1.0.0-alpha25 (including) | 1.0.0-alpha25 (including) |
| Rustfs | Rustfs | 1.0.0-alpha26 (including) | 1.0.0-alpha26 (including) |
| Rustfs | Rustfs | 1.0.0-alpha27 (including) | 1.0.0-alpha27 (including) |
| Rustfs | Rustfs | 1.0.0-alpha28 (including) | 1.0.0-alpha28 (including) |
| Rustfs | Rustfs | 1.0.0-alpha29 (including) | 1.0.0-alpha29 (including) |
| Rustfs | Rustfs | 1.0.0-alpha30 (including) | 1.0.0-alpha30 (including) |
| Rustfs | Rustfs | 1.0.0-alpha31 (including) | 1.0.0-alpha31 (including) |
| Rustfs | Rustfs | 1.0.0-alpha32 (including) | 1.0.0-alpha32 (including) |
| Rustfs | Rustfs | 1.0.0-alpha33 (including) | 1.0.0-alpha33 (including) |
| Rustfs | Rustfs | 1.0.0-alpha34 (including) | 1.0.0-alpha34 (including) |
| Rustfs | Rustfs | 1.0.0-alpha35 (including) | 1.0.0-alpha35 (including) |
| Rustfs | Rustfs | 1.0.0-alpha36 (including) | 1.0.0-alpha36 (including) |
| Rustfs | Rustfs | 1.0.0-alpha37 (including) | 1.0.0-alpha37 (including) |
| Rustfs | Rustfs | 1.0.0-alpha38 (including) | 1.0.0-alpha38 (including) |
| Rustfs | Rustfs | 1.0.0-alpha39 (including) | 1.0.0-alpha39 (including) |
| Rustfs | Rustfs | 1.0.0-alpha40 (including) | 1.0.0-alpha40 (including) |
| Rustfs | Rustfs | 1.0.0-alpha41 (including) | 1.0.0-alpha41 (including) |
| Rustfs | Rustfs | 1.0.0-alpha42 (including) | 1.0.0-alpha42 (including) |
| Rustfs | Rustfs | 1.0.0-alpha43 (including) | 1.0.0-alpha43 (including) |
| Rustfs | Rustfs | 1.0.0-alpha44 (including) | 1.0.0-alpha44 (including) |
| Rustfs | Rustfs | 1.0.0-alpha45 (including) | 1.0.0-alpha45 (including) |
| Rustfs | Rustfs | 1.0.0-alpha46 (including) | 1.0.0-alpha46 (including) |
| Rustfs | Rustfs | 1.0.0-alpha47 (including) | 1.0.0-alpha47 (including) |
| Rustfs | Rustfs | 1.0.0-alpha48 (including) | 1.0.0-alpha48 (including) |
| Rustfs | Rustfs | 1.0.0-alpha49 (including) | 1.0.0-alpha49 (including) |
| Rustfs | Rustfs | 1.0.0-alpha50 (including) | 1.0.0-alpha50 (including) |
| Rustfs | Rustfs | 1.0.0-alpha51 (including) | 1.0.0-alpha51 (including) |
| Rustfs | Rustfs | 1.0.0-alpha52 (including) | 1.0.0-alpha52 (including) |
| Rustfs | Rustfs | 1.0.0-alpha53 (including) | 1.0.0-alpha53 (including) |
| Rustfs | Rustfs | 1.0.0-alpha54 (including) | 1.0.0-alpha54 (including) |
| Rustfs | Rustfs | 1.0.0-alpha55 (including) | 1.0.0-alpha55 (including) |
| Rustfs | Rustfs | 1.0.0-alpha56 (including) | 1.0.0-alpha56 (including) |
| Rustfs | Rustfs | 1.0.0-alpha57 (including) | 1.0.0-alpha57 (including) |
| Rustfs | Rustfs | 1.0.0-alpha58 (including) | 1.0.0-alpha58 (including) |
| Rustfs | Rustfs | 1.0.0-alpha59 (including) | 1.0.0-alpha59 (including) |
| Rustfs | Rustfs | 1.0.0-alpha60 (including) | 1.0.0-alpha60 (including) |
| Rustfs | Rustfs | 1.0.0-alpha61 (including) | 1.0.0-alpha61 (including) |
| Rustfs | Rustfs | 1.0.0-alpha62 (including) | 1.0.0-alpha62 (including) |
| Rustfs | Rustfs | 1.0.0-alpha63 (including) | 1.0.0-alpha63 (including) |
| Rustfs | Rustfs | 1.0.0-alpha64 (including) | 1.0.0-alpha64 (including) |
| Rustfs | Rustfs | 1.0.0-alpha65 (including) | 1.0.0-alpha65 (including) |
| Rustfs | Rustfs | 1.0.0-alpha66 (including) | 1.0.0-alpha66 (including) |
| Rustfs | Rustfs | 1.0.0-alpha67 (including) | 1.0.0-alpha67 (including) |
| Rustfs | Rustfs | 1.0.0-alpha68 (including) | 1.0.0-alpha68 (including) |
| Rustfs | Rustfs | 1.0.0-alpha69 (including) | 1.0.0-alpha69 (including) |
| Rustfs | Rustfs | 1.0.0-alpha70 (including) | 1.0.0-alpha70 (including) |
| Rustfs | Rustfs | 1.0.0-alpha71 (including) | 1.0.0-alpha71 (including) |
| Rustfs | Rustfs | 1.0.0-alpha72 (including) | 1.0.0-alpha72 (including) |
| Rustfs | Rustfs | 1.0.0-alpha73 (including) | 1.0.0-alpha73 (including) |
| Rustfs | Rustfs | 1.0.0-alpha74 (including) | 1.0.0-alpha74 (including) |
| Rustfs | Rustfs | 1.0.0-alpha75 (including) | 1.0.0-alpha75 (including) |
| Rustfs | Rustfs | 1.0.0-alpha76 (including) | 1.0.0-alpha76 (including) |
| Rustfs | Rustfs | 1.0.0-alpha77 (including) | 1.0.0-alpha77 (including) |
| Rustfs | Rustfs | 1.0.0-alpha78 (including) | 1.0.0-alpha78 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html