-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rustfs | rust | >= 1.0.0-alpha.13, <= 1.0.0-alpha.78 | 1.0.0-alpha.79 |
Miggo AIRoot Cause AnalysisThe vulnerability is a privilege escalation in RustFS's IAM system, rooted in a logical flaw within the policy::policy::Policy::is_allowed function. When this function was invoked with the deny_only flag set to true, it would incorrectly grant permission by returning true without verifying any Allow rules in the associated policy. This flaw was exploitable through various admin operations that set the deny_only flag. The primary exploit path, as demonstrated by the proof-of-concept, involved the creation of a new service account. The rustfs::admin::handlers::service_account::AddServiceAccount::handle function would set deny_only=true when a restricted service account attempted to create a new service account for itself. This action allowed the creation of a new service account without any attached policy, causing it to inherit the full permissions of its parent and thereby escalating privileges.
The security patch addresses this vulnerability through a two-pronged approach. First, it rectifies the logic in policy::policy::Policy::is_allowed to return false when deny_only is true, thereby enforcing the requirement for an explicit Allow rule. Second, it removes the logic that sets deny_only=true in the handle methods of AddServiceAccount, AddUser, and GetUserInfo, ensuring these operations consistently require explicit permissions.
Consequently, the vulnerable functions are Policy::is_allowed due to its flawed authorization logic, and the handle methods of AddServiceAccount, AddUser, and GetUserInfo, which served as vectors to exploit this flaw. During an exploit following the PoC, rustfs::admin::handlers::service_account::AddServiceAccount::handle would be the primary function observed in a runtime profile, which then calls the vulnerable is_allowed function.
policy::policy::Policy::is_allowedcrates/policy/src/policy/policy.rs
admin::handlers::service_account::AddServiceAccount::handlerustfs/src/admin/handlers/service_account.rs
admin::handlers::user::AddUser::handlerustfs/src/admin/handlers/user.rs
admin::handlers::user::GetUserInfo::handlerustfs/src/admin/handlers/user.rs