-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists because the ImportIam admin API operation incorrectly checks for ExportIAMAction permission instead of ImportIAMAction. This allows a user with lower-privileged export permissions to perform highly-privileged import actions, such as creating or modifying users, groups, and policies, leading to privilege escalation. The analysis of the patch confirms this directly. By comparing the vulnerable version 1.0.0-alpha.78 with the patched version 1.0.0-alpha.79, I identified the fixing commit b95bee64b2fb55e88c0c0a2205d6be9e143c202f. The patch in the file rustfs/src/admin/handlers/user.rs clearly shows the change from AdminAction::ExportIAMAction to AdminAction::ImportIAMAction within the ImportIam::call function. This function is the entry point for the vulnerable API call and is the precise location of the flawed authorization check.
ImportIam::callrustfs/src/admin/handlers/user.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rustfs | rust | < 1.0.0-alpha.79 | 1.0.0-alpha.79 |