RustFS Authentication Bypass via Header Injection

Executive Summary

RustFS before 1.0.0-beta.12 has a flaw where attacker-controlled HTTP headers can overwrite server-derived identity condition keys used in IAM policies. The system merges headers into a condition-value map after deriving identity, allowing header injection to append or replace values like userid, groups, or jwt claims. This lets authenticated users bypass identity-based policies or evade group restrictions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking RustFS version and inspecting HTTP headers for potential header injection. Verify if your RustFS version is below 1.0.0-beta.12. Monitor for unusual header values in requests that match server-derived condition keys like aws:userid or jwt:sub.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to data or operations by manipulating policy conditions. They might append to allowed groups to satisfy policy checks or replace group memberships to bypass deny policies. This could lead to data theft, unauthorized modifications, or privilege escalation within the RustFS storage system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining access controls. GDPR requires strict data access controls and HIPAA mandates role-based access; this flaw could lead to breaches of confidentiality and integrity, resulting in non-compliance and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.12 or later immediately. Review and update IAM policies to ensure they do not rely solely on header-derived values for authorization. Implement strict input validation for all HTTP headers.

Useful 0 Not Useful 0