Listen to this Post
The vulnerability resides in the ImportIam admin API endpoint within RustFS’s IAM module. Authorization is incorrectly implemented by validating permissions against the ExportIAMAction instead of the ImportIAMAction. This mismatch occurs in the `validate_admin_request` function call inside the `ImportIam::call` method. Consequently, any IAM principal (user or role) granted only IAM export permissions can successfully authenticate and execute the import operation. The import function performs privileged write actions to the IAM database, including creating or updating users, groups, policies, and service accounts. By submitting a crafted ZIP archive containing new IAM entities, an attacker with export privileges can escalate their own permissions or create new administrative accounts. The system mistakenly approves the request because it checks for the wrong action type, bypassing the intended security control. This logic flaw allows a low-privilege user to modify the entire IAM state, leading to full compromise of the RustFS instance’s authorization framework.
dailycve form:
Platform: RustFS
Version: Unspecified
Vulnerability: Authorization Bypass
Severity: Critical
date: 2023-10-01
Prediction: Patch ETA Q4 2023
What Undercode Say:
Analytics:
rustfs-iam list-principals --permissions ExportIAMAction rustfs-iam create-archive --entity malicious-policy.json curl -X POST -H "Authorization: Bearer $TOKEN" -F "[email protected]" $ENDPOINT/admin/import-iam
How Exploit:
Obtain export-only credentials.
Craft IAM import archive.
POST archive to import endpoint.
Validate privilege escalation.
Protection from this CVE:
Patch authorization check.
Use ImportIAMAction validation.
Audit export permission assignments.
Impact:
Full IAM compromise.
Privilege escalation.
Unauthorized administrative access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
