-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a replay attack vector in lakeFS's S3 gateway due to missing timestamp validation for authenticated requests using AWS Signature Version 4. An attacker who captures a valid signed request can replay it until the credentials are rotated.
The analysis of the patch commit 92966ae611d7f1a2bbe7fd56f9568c975aab2bd8 reveals the root cause and the fix. The core of the vulnerability was in the signature verification logic for S3 requests.
The key vulnerable functions identified are:
sig.V4Verify in pkg/gateway/sig/v4.go: This function is responsible for the final verification of the request's signature. The patch introduces a call to a new verifyExpiration function within V4Verify. Before this change, V4Verify would validate the signature but would not check if the request's timestamp (X-Amz-Date) was within an acceptable time window or if the presigned URL had expired (based on X-Amz-Expires). This omission is what allowed for replay attacks.
sig.ParseV4AuthContext in pkg/gateway/sig/v4.go: This function is responsible for parsing the request and extracting the necessary components for signature verification. The patch adds logic to this function to specifically look for and parse presigned URL parameters, including X-Amz-Expires. Without parsing this expiration information, the V4Verify function would not have the necessary data to perform the expiration check.
The newly added function verificationCtx.verifyExpiration contains the actual logic for checking the timestamp against the current time, accounting for clock skew and the expiration duration specified in presigned URLs.
In a runtime profile during an exploit, sig.ParseV4AuthContext would be called first to process the incoming request, followed by sig.V4Verify which would (in a vulnerable version) incorrectly approve a replayed request. Therefore, both functions are critical runtime indicators of this vulnerability.
sig.V4Verifypkg/gateway/sig/v4.go
sig.ParseV4AuthContextpkg/gateway/sig/v4.go
verificationCtx.verifyExpirationpkg/gateway/sig/v4.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/treeverse/lakefs | go | < 1.75.0 | 1.75.0 |