RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.
Weakness
The product writes sensitive information to a log file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rustfs | Rustfs | 1.0.0-alpha1 (including) | 1.0.0-alpha1 (including) |
| Rustfs | Rustfs | 1.0.0-alpha10 (including) | 1.0.0-alpha10 (including) |
| Rustfs | Rustfs | 1.0.0-alpha11 (including) | 1.0.0-alpha11 (including) |
| Rustfs | Rustfs | 1.0.0-alpha12 (including) | 1.0.0-alpha12 (including) |
| Rustfs | Rustfs | 1.0.0-alpha13 (including) | 1.0.0-alpha13 (including) |
| Rustfs | Rustfs | 1.0.0-alpha14 (including) | 1.0.0-alpha14 (including) |
| Rustfs | Rustfs | 1.0.0-alpha15 (including) | 1.0.0-alpha15 (including) |
| Rustfs | Rustfs | 1.0.0-alpha16 (including) | 1.0.0-alpha16 (including) |
| Rustfs | Rustfs | 1.0.0-alpha17 (including) | 1.0.0-alpha17 (including) |
| Rustfs | Rustfs | 1.0.0-alpha18 (including) | 1.0.0-alpha18 (including) |
| Rustfs | Rustfs | 1.0.0-alpha19 (including) | 1.0.0-alpha19 (including) |
| Rustfs | Rustfs | 1.0.0-alpha2 (including) | 1.0.0-alpha2 (including) |
| Rustfs | Rustfs | 1.0.0-alpha20 (including) | 1.0.0-alpha20 (including) |
| Rustfs | Rustfs | 1.0.0-alpha21 (including) | 1.0.0-alpha21 (including) |
| Rustfs | Rustfs | 1.0.0-alpha22 (including) | 1.0.0-alpha22 (including) |
| Rustfs | Rustfs | 1.0.0-alpha23 (including) | 1.0.0-alpha23 (including) |
| Rustfs | Rustfs | 1.0.0-alpha24 (including) | 1.0.0-alpha24 (including) |
| Rustfs | Rustfs | 1.0.0-alpha25 (including) | 1.0.0-alpha25 (including) |
| Rustfs | Rustfs | 1.0.0-alpha26 (including) | 1.0.0-alpha26 (including) |
| Rustfs | Rustfs | 1.0.0-alpha27 (including) | 1.0.0-alpha27 (including) |
| Rustfs | Rustfs | 1.0.0-alpha28 (including) | 1.0.0-alpha28 (including) |
| Rustfs | Rustfs | 1.0.0-alpha29 (including) | 1.0.0-alpha29 (including) |
| Rustfs | Rustfs | 1.0.0-alpha3 (including) | 1.0.0-alpha3 (including) |
| Rustfs | Rustfs | 1.0.0-alpha30 (including) | 1.0.0-alpha30 (including) |
| Rustfs | Rustfs | 1.0.0-alpha31 (including) | 1.0.0-alpha31 (including) |
| Rustfs | Rustfs | 1.0.0-alpha32 (including) | 1.0.0-alpha32 (including) |
| Rustfs | Rustfs | 1.0.0-alpha33 (including) | 1.0.0-alpha33 (including) |
| Rustfs | Rustfs | 1.0.0-alpha34 (including) | 1.0.0-alpha34 (including) |
| Rustfs | Rustfs | 1.0.0-alpha35 (including) | 1.0.0-alpha35 (including) |
| Rustfs | Rustfs | 1.0.0-alpha36 (including) | 1.0.0-alpha36 (including) |
| Rustfs | Rustfs | 1.0.0-alpha37 (including) | 1.0.0-alpha37 (including) |
| Rustfs | Rustfs | 1.0.0-alpha38 (including) | 1.0.0-alpha38 (including) |
| Rustfs | Rustfs | 1.0.0-alpha39 (including) | 1.0.0-alpha39 (including) |
| Rustfs | Rustfs | 1.0.0-alpha4 (including) | 1.0.0-alpha4 (including) |
| Rustfs | Rustfs | 1.0.0-alpha40 (including) | 1.0.0-alpha40 (including) |
| Rustfs | Rustfs | 1.0.0-alpha41 (including) | 1.0.0-alpha41 (including) |
| Rustfs | Rustfs | 1.0.0-alpha42 (including) | 1.0.0-alpha42 (including) |
| Rustfs | Rustfs | 1.0.0-alpha43 (including) | 1.0.0-alpha43 (including) |
| Rustfs | Rustfs | 1.0.0-alpha44 (including) | 1.0.0-alpha44 (including) |
| Rustfs | Rustfs | 1.0.0-alpha45 (including) | 1.0.0-alpha45 (including) |
| Rustfs | Rustfs | 1.0.0-alpha46 (including) | 1.0.0-alpha46 (including) |
| Rustfs | Rustfs | 1.0.0-alpha47 (including) | 1.0.0-alpha47 (including) |
| Rustfs | Rustfs | 1.0.0-alpha48 (including) | 1.0.0-alpha48 (including) |
| Rustfs | Rustfs | 1.0.0-alpha49 (including) | 1.0.0-alpha49 (including) |
| Rustfs | Rustfs | 1.0.0-alpha5 (including) | 1.0.0-alpha5 (including) |
| Rustfs | Rustfs | 1.0.0-alpha50 (including) | 1.0.0-alpha50 (including) |
| Rustfs | Rustfs | 1.0.0-alpha51 (including) | 1.0.0-alpha51 (including) |
| Rustfs | Rustfs | 1.0.0-alpha52 (including) | 1.0.0-alpha52 (including) |
| Rustfs | Rustfs | 1.0.0-alpha53 (including) | 1.0.0-alpha53 (including) |
| Rustfs | Rustfs | 1.0.0-alpha54 (including) | 1.0.0-alpha54 (including) |
| Rustfs | Rustfs | 1.0.0-alpha55 (including) | 1.0.0-alpha55 (including) |
| Rustfs | Rustfs | 1.0.0-alpha56 (including) | 1.0.0-alpha56 (including) |
| Rustfs | Rustfs | 1.0.0-alpha57 (including) | 1.0.0-alpha57 (including) |
| Rustfs | Rustfs | 1.0.0-alpha58 (including) | 1.0.0-alpha58 (including) |
| Rustfs | Rustfs | 1.0.0-alpha59 (including) | 1.0.0-alpha59 (including) |
| Rustfs | Rustfs | 1.0.0-alpha6 (including) | 1.0.0-alpha6 (including) |
| Rustfs | Rustfs | 1.0.0-alpha60 (including) | 1.0.0-alpha60 (including) |
| Rustfs | Rustfs | 1.0.0-alpha61 (including) | 1.0.0-alpha61 (including) |
| Rustfs | Rustfs | 1.0.0-alpha62 (including) | 1.0.0-alpha62 (including) |
| Rustfs | Rustfs | 1.0.0-alpha63 (including) | 1.0.0-alpha63 (including) |
| Rustfs | Rustfs | 1.0.0-alpha64 (including) | 1.0.0-alpha64 (including) |
| Rustfs | Rustfs | 1.0.0-alpha65 (including) | 1.0.0-alpha65 (including) |
| Rustfs | Rustfs | 1.0.0-alpha66 (including) | 1.0.0-alpha66 (including) |
| Rustfs | Rustfs | 1.0.0-alpha67 (including) | 1.0.0-alpha67 (including) |
| Rustfs | Rustfs | 1.0.0-alpha68 (including) | 1.0.0-alpha68 (including) |
| Rustfs | Rustfs | 1.0.0-alpha69 (including) | 1.0.0-alpha69 (including) |
| Rustfs | Rustfs | 1.0.0-alpha7 (including) | 1.0.0-alpha7 (including) |
| Rustfs | Rustfs | 1.0.0-alpha70 (including) | 1.0.0-alpha70 (including) |
| Rustfs | Rustfs | 1.0.0-alpha71 (including) | 1.0.0-alpha71 (including) |
| Rustfs | Rustfs | 1.0.0-alpha72 (including) | 1.0.0-alpha72 (including) |
| Rustfs | Rustfs | 1.0.0-alpha73 (including) | 1.0.0-alpha73 (including) |
| Rustfs | Rustfs | 1.0.0-alpha74 (including) | 1.0.0-alpha74 (including) |
| Rustfs | Rustfs | 1.0.0-alpha75 (including) | 1.0.0-alpha75 (including) |
| Rustfs | Rustfs | 1.0.0-alpha76 (including) | 1.0.0-alpha76 (including) |
| Rustfs | Rustfs | 1.0.0-alpha77 (including) | 1.0.0-alpha77 (including) |
| Rustfs | Rustfs | 1.0.0-alpha78 (including) | 1.0.0-alpha78 (including) |
| Rustfs | Rustfs | 1.0.0-alpha79 (including) | 1.0.0-alpha79 (including) |
| Rustfs | Rustfs | 1.0.0-alpha8 (including) | 1.0.0-alpha8 (including) |
| Rustfs | Rustfs | 1.0.0-alpha9 (including) | 1.0.0-alpha9 (including) |