Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T15:18:32.060Z",
  "pubdate": "2026-08-12T15:18:32.060Z",
  "executiveSummary": "RustFS prior to version 1.0.0-beta.12 suffers from an improper authorization and condition evaluation vulnerability in the get_condition_values function. The flaw allows authenticated callers to manipulate identity-based policy conditions by injecting arbitrary attacker-controlled request headers via the HeaderMap into critical server-derived security context keys.\nThe vulnerability directly impacts the integrity of access control decisions within the distributed object storage system. By successfully exploiting this flaw, an authenticated malicious actor can impersonate other users, elevate privileges, and bypass fine-grained identity-based access control policies.\nThe attack requires authentication to the RustFS system, granting the attacker the capability to craft malicious HTTP requests containing manipulated headers. The root cause lies in the unsafe incorporation of unvalidated client-supplied HTTP headers into internal policy evaluation keys such as userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap:.\nRisk implications include unauthorized data access, modification, or deletion of stored objects due to broken authorization controls. Organizations utilizing affected versions of RustFS are at risk of complete policy enforcement bypass by authenticated users.",
  "technicalDetails": "The vulnerability resides within the authorization evaluation subsystem of RustFS, specifically inside the get_condition_values function responsible for gathering context for policy evaluation. During the handling of incoming requests, the application processes the underlying HeaderMap containing client-supplied HTTP headers.\nThe root cause of the vulnerability is the improper handling and folding of attacker-controlled request headers directly into server-derived authorization condition keys without adequate sanitization, validation, or validation against trusted server-side state. Specifically, untrusted header data is merged into critical security evaluation namespaces including userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap:.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker crafts a malicious HTTP request targeting the RustFS API. Within this request, the attacker injects specific, maliciously crafted headers designed to mimic valid identity or session parameters recognized by the get_condition_values function. Second, upon receiving the request, RustFS invokes get_condition_values, which iterates over the HeaderMap and folds the injected header values into the policy condition context.\nBecause the application erroneously treats these client-supplied header values as server-derived security tokens or authoritative identity attributes, the policy evaluation engine assesses the request against the falsified context. Consequently, security policies configured to restrict access based on userid, groups, or authentication mechanisms (such as jwt: or ldap:) evaluate to true despite the caller lacking the legitimate credentials or group memberships.\nThe affected component is the header processing and condition evaluation logic within RustFS prior to version 1.0.0-beta.12. Exploitation requires the attacker to possess valid authentication to interact with the storage system, but no special administrative privileges are required. The attack vector is exposed via network interfaces handling client requests. Post-exploitation impact encompasses unauthorized read and write access to distributed objects, enabling horizontal and vertical privilege escalation across the storage infrastructure."
}