Listen to this Post
The vulnerability in LakeFS’s S3 gateway stems from improper validation of timestamps in authenticated requests. When a request is signed using AWS Signature Version 4 or similar mechanisms, it includes a timestamp to ensure the request is only valid within a specific time window, preventing replay attacks. However, LakeFS’s S3 gateway does not check this timestamp, allowing any signed request to be accepted regardless of its age. An attacker who intercepts a valid request—via network eavesdropping, exposed logs, or compromised systems—can capture the full HTTP request including headers and signature. This captured request can then be replayed repeatedly to the S3 gateway, performing unauthorized actions such as reading, writing, or deleting data. The replayed request will succeed as long as the credentials used to sign the original request remain active, even if the intended expiration time has passed. This issue affects all LakeFS versions through v1.74.4, where the gateway processes S3-compatible API calls without time-based validation, effectively bypassing the expiration mechanism designed to limit request validity.
Platform: LakeFS
Version: <= v1.74.4
Vulnerability: Timestamp validation bypass
Severity: Critical
date: Not disclosed
Prediction: Patched v1.75.0
What Undercode Say:
Analytics:
bash commands:
tcpdump -i eth0 port 80
curl -H “Authorization: …”
codes:
N/A
how Exploit:
Capture signed request via interception. Replay using tools like curl or scripts. Request executes until credential rotation.
Protection from this CVE:
Upgrade to v1.75.0. Use short-lived credentials. Implement network IP restrictions.
Impact:
Replay attacks possible. Unauthorized data access. Bypasses expiration controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
