GHSA-pq29-69jg-9mxc: RustFS Path Traversal Vulnerability
RustFS Path Traversal VulnerabilityVulnerability Details**CVE ID**:**Severity**: Critical (CVSS estimated 9.9)**Impact**: Arbitrary File Read/Write**Component**: `/rustfs/rpc/read_file_stream` endpoint**Root Cause**: Insufficient path validation in `crates/ecstore/src/disk/local.rs:1791`Vulnerable CodeThe code uses `PathBuf::join()` without:CanonicalizationPath boundary validationProtection against `../` sequencesProtection against absolute pathsProof of ConceptTest Environment**Target**: RustFS v0.0.5 (Docker container)**Endpoint**: `http://localhost:9000/rustfs/rpc/read_file_stream`**RPC Secret**: `rustfsadmin` (from RUSTFS_SECRET_KEY)**Disk ID**: `/data/rustfs0`**Volume**: `.rustfs.sys`Attack ScenarioExploit ParametersRequired AuthenticationRPC requests require HMAC-SHA256 signature:Successful Exploits1. Read `/etc/passwd` ✅**Request:****Response:** HTTP 200 OK**Content Retrieved:****Impact**: Full user account enumeration2. Read `/etc/hosts` ✅**Request:****Response:** HTTP 200 OK**Content Retrieved:****Impact**: Network configuration disclosure3. Read `/etc/hostname` ✅**Request:****Response:** HTTP 200 OK**Content Retrieved:****Impact**: System information disclosureTechnical AnalysisData FlowPath Traversal MechanismWhy It Works**No Canonicalization**: Code doesn't use `canonicalize()` before validation**No Boundary Check**: No verification that final path is within volume_dir**PathBuf::join() Behavior**: Automatically resolves `../` sequences**Length-Only Validation**: `check_path_length()` only checks string lengthSpecial Considerations**File Size Constraint**: The `length` parameter must exactly match file sizeCode validates: `file.len() >= offset + length`Otherwise returns `DiskError::FileCorrupt`**Volume Requirement**: Volume/bucket must exist (e.g., `.rustfs.sys`)**Disk Requirement**: Disk must be registered in `GLOBAL_LOCAL_DISK_MAP`Impact AssessmentConfidentiality Impact: HIGH✅ Read arbitrary files (demonstrated)✅ Read system configuration files (`/etc/passwd`, `/etc/hosts`)⚠️ Potential to read:SSH keys (`/root/.ssh/id_rsa`)Application secretsRustFS configuration filesEnvironment variables from `/proc`Integrity Impact: HIGH⚠️ Similar vulnerability exists in `put_file_stream` (not tested)⚠️ Arbitrary file write likely possible⚠️ Could write to:Cron jobsauthorized_keysSystem binaries (if permissions allow)Availability Impact: MEDIUM⚠️ `walk_dir` endpoint could enumerate entire filesystem⚠️ Potential DoS via recursive directory traversalExploitation RequirementsPrerequisites**Network Access**: Ability to reach RustFS RPC endpoints**RPC Secret Knowledge**: Knowledge of RUSTFS_SECRET_KEYDefault: `"rustfs-default-secret"`Production: From environment variable or config**Disk/Volume Knowledge**: Valid disk ID and volume name**File Size Knowledge**: Exact file sizes for successful readsAttack Complexity**Without Secret**: Impossible (signature verification)**With Secret**: Trivial (automated script)**With Default Secret**: Critical risk if not changedMitigation RecommendationsImmediate Actions (Priority 0)**Path Canonicalization****Path Component Validation****Use path-clean Crate**Additional Security Measures**Audit Logging**: Log all RPC file operations with full paths**Rate Limiting**: Prevent DoS via repeated RPC calls**Secret Rotation**: Ensure unique RPC secrets per deployment**Network Segmentation**: Restrict RPC endpoint access**Security Testing**: Add path traversal tests to test suiteLong-term Improvements**Chroot Jail**: Isolate RPC operations in chroot environment**Least Privilege**: Run RustFS with minimal file system permissions**Security Audit**: Comprehensive review of all file operationsProof of Concept ScriptThe complete PoC is available at: `exploit_path_traversal.py`UsageOutputAcknowledgementsRustFS would like to thank **bilisheep** from the **Xmirror Security Team** for discovering and responsibly reporting this vulnerability.Acknowledgements: RustFS would like to thank @realansgar and  **bilisheep** from the **Xmirror Security Team** for providing the security report.
CVSS v4.0: 8.8