GitHub Security Advisory: GHSA-pfcq-4gjr-6gjm
Package: rustfs (RUST)
Severity: HIGH (CVSS 8.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.0.2
Patched in: unpatched

Summary: RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

Details:
# Missing Admin Auth on Notification Target Endpoints in RustFS


### Finding Summary

All four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization.

A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion.

### What Was Proven Live

1. **Authorization bypass on all four endpoints** (03_readonly_user_bypass.py)
   - PUT, GET list, GET arns, DELETE all return 200 for readonly-user
   - Control routes (list-users, kms/status) correctly return 403
   - Unauthenticated requests correctly rejected (403 Signature required)

2. **SSRF via health probe** (04_ssrf_listener_landing.py)
   - HEAD request from rustfs container to attacker-controlled listener
   - No host validation: only scheme check (http/https)

3. **Target hijacking and event exfiltration** (05_target_hijacking.py, 06_full_event_exfil.py)
   - Readonly-user overwrites admin-configured target URL by name
   - Subsequent S3 events delivered to attacker-controlled endpoint
   - Captured event body includes object keys, bucket names, user identities, and request metadata

4. **Audit evasion** (05_target_hijacking.py)
   - Readonly-user can delete unbound targets
   - Readonly-user can overwrite bound targets (silently redirecting events)

### Escalation Vectors Tested But Not Viable

1. **Self-referencing webhook to admin API** (13_self_referencing_test.py)
   - Webhook sends unsigned POST with event JSON body
   - Admin endpoints require SigV4 auth -- unsigned request rejected
   - "Confused deputy" via self-referencing does NOT work

2. **Protocol smuggling via non-HTTP targets**
   - Only 2 target types implemented: webhook and MQTT (`event.rs:613` enforces this)
   - No Redis, Kafka, AMQP, or other protocol targets exist
   - CRLF injection in webhook config fields sanitized by reqwest
   - MQTT uses rumqttc (pure Rust binary protocol client), no raw TCP injection

3. **MQTT target for RCE**
   - No unsafe code in MQTT handler
   - rumqttc 0.29.0 has no known public CVEs
   - No Command::new, template engines, or deserialization of broker responses

4. **Unauth access**
   - Endpoints correctly reject unauthenticated requests (403)
   - Endpoints correctly reject invalid credentials (403)

### Prior Art

No existing advisory covers notification target endpoints. 11 published GHSAs on rustfs/rustfs cover different handlers. Closest:
- CVE-2026-22042 (ImportIam wrong action constant) -- same bug class, different file
- CVE-2026-22043 (deny_only sh