Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T15:18:32.237Z",
  "pubdate": "2026-08-12T15:18:32.237Z",
  "executiveSummary": "An authorization bypass vulnerability exists in RustFS prior to version 1.0.0-beta.12 within the FTPS protocol handling implementation. The vulnerability is classified as an authorization bypass, allowing authenticated users who have been explicitly denied the s3:CreateBucket permission to successfully create buckets via the FTPS MKD command. The impact of this security flaw includes unauthorized resource provisioning and circumvention of access control lists and permission policies enforced by the storage system. Affected systems are instances of RustFS running versions prior to 1.0.0-beta.12 that expose the FTPS protocol interface. The risk implications are severe for multi-tenant or strictly governed environments where users operate under the Principle of Least Privilege. The attacker capabilities required to exploit this vulnerability include authenticated access to the FTPS service. Exploitation requirements necessitate that the attacker interacts with the FTPS endpoint and issues standard directory creation commands, bypassing the intended authorization checks normally validated during S3 bucket creation operations.",
  "technicalDetails": "The vulnerability resides in the FTPS protocol driver component of RustFS, specifically within the FtpsDriver::mkd function located at crates/protocols/src/ftps/driver.rs. The root cause of the issue is a failure to enforce proper access control mechanisms during the execution of the FTPS MKD command. When processing an FTPS MKD request, the driver directly invokes the storage.create_bucket storage backend method without first performing an authorization check via authorize_operation for the corresponding S3Action::CreateBucket action. In a correctly implemented authorization flow, the application must intercept protocol-specific commands and validate them against the requesting user's identity, role-based access controls, or permission policies. Because the FTPS driver omits this critical authorization validation step, any successfully authenticated FTPS user can bypass the policy enforcement layer and instantiate new buckets regardless of explicit access denials configured for the s3:CreateBucket action. The attack flow begins when an authenticated adversary connects to the RustFS FTPS interface and transmits an MKD command targeting a specific directory path that maps to a bucket creation operation. The vulnerable FtpsDriver::mkd function receives the request and immediately initiates the storage.create_bucket routine without verifying whether the security context of the session permits the s3:CreateBucket action. Consequently, the backend creates the requested bucket, granting unauthorized resource allocation to the actor. The vulnerable component is the FtpsDriver implementation within the crates/protocols/src/ftps/driver.rs file. Affected versions include all RustFS releases prior to 1.0.0-beta.12. The prerequisite for exploitation is valid user authentication against the FTPS service, but privilege requirements are minimal as even low-privileged or restricted users denied bucket creation capabilities can exploit the flaw due to the missing permission evaluation."
}