GHSA-h956-rh7x-ppgj RustFS has a gRPC Hardcoded Token Authentication Bypass
Vulnerability OverviewDescriptionRustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is:**Publicly exposed** in the source code repository**Hardcoded** on both client and server sides**Non-configurable** with no mechanism for token rotation**Universally valid** across all RustFS deploymentsAny attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes.CVSS 3.1 Score**Score**: 9.8 (Critical)
**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**Attack Vector (AV)**: Network - Exploitable remotely**Attack Complexity (AC)**: Low - No special conditions required**Privileges Required (PR)**: None - No authentication needed (bypassed)**User Interaction (UI)**: None - Fully automated exploitation**Scope (S)**: Unchanged - Impact contained to vulnerable component**Confidentiality (C)**: High - Complete data disclosure**Integrity (I)**: High - Complete data modification capability**Availability (A)**: High - Complete service disruption capabilityVulnerable Code AnalysisServer-Side Authentication (rustfs/src/server/http.rs:679-686)**Issues**:Static token hardcoded as string literalNo configuration mechanism (environment variable, file, etc.)Token visible in public GitHub repositoryIdentical across all installationsClient-Side Authentication (crates/protos/src/lib.rs:153-174)**Issues**:Client uses identical hardcoded tokenNo secure token distribution mechanismToken cannot be rotated without code changesService Integration (rustfs/src/server/http.rs:520-521)The `check_auth` interceptor is applied to all gRPC services via `NodeServiceServer::with_interceptor`, protecting **all 50+ gRPC methods** in `node.proto` with the same weak authentication.Reproduction StepsEnvironment Setup**Test Environment**:RustFS Server: `localhost:9000` (HTTP + gRPC hybrid service)RustFS Console: `localhost:9001`Container: `rustfs/rustfs:latest` (Docker Compose deployment)Default credentials: `rustfsadmin/rustfsadmin`**Tools Required**:`grpcurl` v1.9.3+ (gRPC command-line client)RustFS proto files: `crates/protos/src/node.proto`Step 1: Verify Authentication is Enforced**Test 1.1: Request without authentication token****Expected Result**: ✅ Authentication failure**Test 1.2: Request with incorrect token****Expected Result**: ✅ Authentication failure**Conclusion**: Authentication is properly enforced - unauthorized requests are rejected.Step 2: Extract Hardcoded Token from Source Code**Public Source Code Analysis**:**Result**: ✅ Token found in public source code**Extracted Token**: `rustfs rpc`Step 3: Exploit - Authenticate Using Hardcoded Token**Test 3.1: Successful authentication with hardcoded token****Result**: 🔓 **AUTHENTICATION BYPASSED****Analysis**: Server accepted the hardcoded token and returned a successful response. Authentication completely bypassed.Step 4: Demonstrate Access to Sensitive Management APIs**Test 4.1: Server Configuration Disclosure****Result**: ✅ **Complete server configuration disclosed****Analysis**:Server returned complete configuration including storage paths, endpoint addresses, version infoBinary data contains sensitive internal state (MessagePack encoded)Information disclosure confirmed**Test 4.2: Disk Information Access****Result**: ✅ **Authenticated request accepted** (business logic error returned, not auth error)**Analysis**:Request passed authentication (error is business logic, not authentication)Proves attacker has authenticated access to sensitive system information APIsImpact AnalysisAffected APIsAll 50+ gRPC methods in `node_service.NodeService` are vulnerable:🔴 **CRITICAL Impact - Data Destruction**`DeleteBucket` - Delete production buckets`DeleteVolume` - Destroy entire storage volumes`DeleteUser` - Remove legitimate users`DeletePolicy` - Remove access control policies`DeleteServiceAccount` - Remove service accounts🔴 **CRITICAL Impact - Configuration Manipulation**`ReloadSiteReplicationConfig` - Corrupt cluster replication`SignalService` - Control service lifecycle`LoadPolicy` - Modify access control policies`LoadPolicyMapping` - Alter policy assignments🟠 **HIGH Impact - Unauthorized Data Access/Modification**`ReadAll` / `ReadAt` - Read arbitrary data`WriteAll` / `WriteStream` - Inject malicious data`RenameFile` / `RenameData` - Manipulate file system`UpdateMetadata` / `WriteMetadata` - Corrupt metadata🟠 **HIGH Impact - Privilege Escalation**`LoadUser` - Access user credentials`LoadServiceAccount` - Access service credentials`LoadGroup` - Access group memberships🟡 **MEDIUM Impact - Information Disclosure**`ServerInfo` - Server configuration disclosure`DiskInfo` - Storage configuration disclosure`GetMetrics` - Performance metrics disclosure`GetBucketStats` - Bucket statistics disclosure`LocalStorageInfo` - Storage system information`ListBucket` - Bucket enumeration🟡 **MEDIUM Impact - Cluster Operations**`MakeBucket` - Unauthorized bucket creation`HealBucket` - Trigger repair operations`BackgroundHealStatus` - Monitor internal operationsAttack ScenariosScenario 1: Data Destruction**Impact**: Complete data loss, business disruptionScenario 2: Credential Harvesting**Impact**: Complete IAM compromise, lateral movementScenario 3: Backdoor Installation**Impact**: Persistent compromise, further exploitationScenario 4: Cluster Disruption**Impact**: Distributed system failure, data inconsistencyExploitation PreconditionsRequired Conditions✅ **All conditions typically met in production deployments**:**Network Access**: Attacker can reach gRPC port (9000/TCP)RustFS binds to `0.0.0.0` by default (all interfaces)Commonly exposed for distributed node communication**Token Knowledge**: Token is publicly knownAvailable in public GitHub repositoryIdentical across all RustFS installationsCannot be changed without code modification**No Additional Security Controls**:No mTLS/certificate-based authenticationNo IP whitelisting (typically)No VPN/network segmentation requirementsNo rate limiting on authentication attemptsAttack Complexity**Complexity**: 🟢 **TRIVIAL**Single `grpcurl` command with hardcoded tokenNo exploit development requiredNo timing or race conditionsNo target-specific reconnaissance neededFully automatableWorks against any RustFS instance**Time to Exploit**: < 1 minuteSecurity ImpactConfidentiality Impact: HIGH**Complete Data Disclosure**: All stored objects readable via `ReadAll`/`ReadAt`**Credential Exposure**: IAM users, service accounts, policies accessible**Configuration Disclosure**: Server, storage, cluster configuration leaked**Metrics Exposure**: Performance and usage metrics accessibleIntegrity Impact: HIGH**Data Modification**: Arbitrary data injection via `WriteAll`/`WriteStream`**Metadata Corruption**: File metadata tampering via `WriteMetadata`**Policy Manipulation**: IAM policies modifiable via `LoadPolicy`**Configuration Changes**: Cluster replication config alterableAvailability Impact: HIGH**Data Destruction**: Buckets/volumes deletable via `DeleteBucket`/`DeleteVolume`**Service Disruption**: Service controllable via `SignalService`**Cluster Degradation**: Replication corruption via `ReloadSiteReplicationConfig`**Resource Exhaustion**: Arbitrary data writes, bucket creationCompliance & Regulatory ImpactStandards ViolatedPCI-DSS v4.0**Requirement 6.5.3**: Broken authentication**Requirement 8.2**: Strong authentication required**Requirement 8.6**: Multi-factor authentication requiredOWASP Top 10 2021**A07:2021 - Identification and Authentication Failures**Use of hard-coded credentialsMissing or ineffective authenticationCWE (Common Weakness Enumeration)**CWE-798**: Use of Hard-coded Credentials (Rank: 37/400)**CWE-1391**: Use of Weak Credentials**CWE-287**: Improper AuthenticationNIST Cybersecurity Framework**PR.AC-1**: Access control mechanisms violated**PR.AC-7**: Authentication mechanisms insufficientSOC 2 Type II**CC6.1**: Logical access controls inadequate**CC6.6**: Credential management controls missingLegal & Business Impact**Data Breach Notification**: GDPR Art. 33, CCPA §1798.150**Regulatory Fines**: GDPR up to €20M or 4% annual revenue**Customer Trust**: Severe reputational damage**Service Disruption**: SLA violations, customer compensation**Incident Response Costs**: Forensics, remediation, legal feesProof of ConceptAutomated POC Script**File**: `audit_analysis/poc_cve_2025_008_grpc_token_working.sh`**Usage**:**Default Target**: `localhost:9000`POC Features✅ **Baseline Authentication Testing**Verifies unauthenticated requests are rejectedVerifies incorrect tokens are rejected✅ **Exploit Demonstration**Authenticates using hardcoded tokenCalls `Ping` service successfully✅ **Sensitive API Access**Accesses `ServerInfo` (configuration disclosure)Accesses `DiskInfo` (system information)Demonstrates authenticated access to management APIs✅ **Detailed Reporting**Displays vulnerable code locationsLists all affected APIs (50+ methods)Provides CVSS scoring and impact analysisIncludes remediation recommendationsPOC Output SummaryAcknowledgementsWe would like to thank **bilisheep** from the **Xmirror Security Team** for discovering and responsibly reporting this vulnerability.
CVSS v3.1 score: 9.8