Listen to this Post
A vulnerability exists in the gRPC implementation of RustFS where the `GetMetrics` endpoint handler lacks proper deserialization error handling. The handler for the `GetMetrics` RPC call at `tonic_service.rs:1775-1782` uses `Deserialize::deserialize(…).unwrap()` on client-supplied `metric_type` and `opts` bytes. The `unwrap()` call assumes successful deserialization of the MessagePack (rmp-serde) payloads. When an attacker sends a malformed request, such as an empty or truncated payload, the deserialization fails. This failure triggers an `InvalidMarkerRead` error or similar deserialization exception. Instead of being caught and returning a client error, the `unwrap()` method is called on this `Err` result. This causes the current thread to panic. This panic terminates the specific worker thread handling that gRPC request. Consequently, the metrics endpoint becomes unresponsive for subsequent requests handled by that thread. The main server process may continue running but can become unstable depending on crash handling. The endpoint is reachable via the same TCP listener as the S3 service, defaulting to port :9000. Protection is minimal, relying only on a static interceptor checking for the `authorization: rustfs rpc` header in server/http.rs:677. Knowledge of this static token is sufficient for exploitation, making it effectively an unauthenticated vulnerability for anyone with network access. This allows any remote attacker who can reach the port and provide the header to repeatedly crash handler threads. The attack results in a reliable denial of service against the metrics service. Repeated attacks could degrade overall server stability by exhausting thread pools or causing cascading failures. The core issue is the improper use of `unwrap()` in a location processing untrusted external input without a validation boundary.
Platform: RustFS
Version: All vulnerable
Vulnerability : Remote DoS panic
Severity: Critical
date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
`rustfs/src/storage/tonic_service.rs:1775-1782`
`server/http.rs:677`
How Exploit:
ENDPOINT=127.0.0.1:9000 make run
grpcurl -plaintext -H 'authorization: rustfs rpc' -d '{"metric_type":"","opts":""}' 127.0.0.1:9000 node_service.NodeService/GetMetrics
Protection from this CVE
Replace `deserialize(…).unwrap()` with proper error handling returning a `grpc::Status` error.
Implement stringent validation for all client-supplied MessagePack fields.
Consider stronger authentication beyond a static token.
Impact
Metrics service disruption.
Potential overall process instability.
Remote unauthenticated denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
