Listen to this Post
The vulnerability exists in the `/rustfs/rpc/read_file_stream` endpoint. The handler in `crates/ecstore/src/disk/local.rs:1791` uses `PathBuf::join()` to concatenate a user-controlled `path` parameter onto a base `volume_dir` without proper sanitization. This allows an attacker to input path traversal sequences like ../../../../etc/passwd. The `join()` method resolves these sequences, allowing escape from the intended directory. The only validation performed is a length check via check_path_length(), which does not prevent traversal. An authenticated RPC request with a valid HMAC-SHA256 signature can exploit this to read arbitrary files from the host filesystem.
DailyCVE Form:
Platform: RustFS
Version: v0.0.5
Vulnerability: Path Traversal
Severity: Critical
date: Not specified
Prediction: Patch expected
What Undercode Say:
Analytics
curl -X GET "http://localhost:9000/rustfs/rpc/read_file_stream?disk=/data/rustfs0&volume=.rustfs.sys&path=../../../../etc/passwd&offset=0&length=751" -H "x-rustfs-signature: QAesB6sNdwKJluifpIhbKyhdK2EEiiyhpvfRJmXZKlg=" -H "x-rustfs-timestamp: 1766482485"
let file_path = volume_dir.join(Path::new(&path)); // Vulnerable code
if path.contains("..") { // Simple fix
return Err(DiskError::InvalidArgument);
}
How Exploit:
Craft HTTP GET request with traversal sequence in `path` parameter and valid RPC signature headers.
Protection from this CVE
Implement path canonicalization and boundary validation. Reject paths containing `..` or absolute paths.
Impact:
Arbitrary file read/write. High confidentiality and integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
