Listen to this Post
The CVE-2025-008 vulnerability in RustFS stems from a static, hardcoded authentication token “rustfs rpc” used for gRPC service access. This token is publicly exposed in the source code, identical on all client and server installations, and has no configuration or rotation mechanism. The server’s `check_auth` function compares the provided authorization header against this literal string. Since the token cannot be changed without modifying the source code, any attacker with network access to the gRPC port (default 9000/TCP) can use this publicly known credential to successfully authenticate. This bypasses all authentication checks, granting the attacker full access to over 50 privileged gRPC methods for data destruction, configuration manipulation, and system control without requiring any valid user credentials.
Platform: RustFS
Version: latest
Vulnerability: Hardcoded Credentials
Severity: Critical
date: 2025-12-31
Prediction: 2025-01-15
What Undercode Say:
$ grep -rn '"rustfs rpc"' --include='.rs' $ grpcurl -plaintext -H 'authorization: rustfs rpc' localhost:9000 node_service.NodeService/Ping $ grpcurl -plaintext -H 'authorization: rustfs rpc' localhost:9000 node_service.NodeService/ServerInfo
How Exploit:
1. Attacker scans for/open RustFS gRPC port (9000).
- Attacker uses the public hardcoded token “rustfs rpc” in the authorization header of any gRPC request.
- Server authenticates the request, granting full access to all administrative APIs.
- Attacker executes commands like DeleteBucket, LoadUser, or SignalService to destroy data, harvest credentials, or disrupt the cluster.
Protection from this CVE:
Remove hardcoded token.
Use environment variables.
Implement proper secret management.
Enable network controls.
Require mTLS authentication.
Impact:
Confidentiality: High (all data readable)
Integrity: High (data modifiable)
Availability: High (service stoppable)
Compliance: Violates PCI-DSS, OWASP
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
