Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T15:18:32.883Z",
  "pubdate": "2026-08-12T15:18:32.883Z",
  "executiveSummary": "RustFS prior to version 1.0.0-beta.12 suffers from an authorization bypass vulnerability affecting the object version listing functionality. The flaw is rooted in access control logic handling anonymous requests within the storage access component. Specifically, an anonymous ListObjectVersions request that lacks a direct bucket-policy grant falls back prematurely to an s3:ListBucket check and returns before policy evaluation enforces necessary restrictions. This prevents the execution of deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets logic. Consequently, buckets configured to permit anonymous listing continue exposing sensitive object version metadata even after operators explicitly enable public-access controls. Attackers lacking authentication can exploit this behavior via the data plane to harvest sensitive metadata concerning object versions. The impact is limited to unauthorized disclosure of version metadata through the GET /<bucket>?versions= endpoint, while standard GetObject requests remain properly restricted. Exploitation requires network exposure to the storage service and a target bucket with legacy anonymous listing permissions where public-access controls were subsequently applied. This issue is fully resolved in version 1.0.0-beta.12.",
  "technicalDetails": "The vulnerability resides in the access control evaluation logic implemented in rustfs/src/storage/access.rs within RustFS prior to version 1.0.0-beta.12. The root cause is an improper authorization check sequencing during anonymous ListObjectVersions requests. When an incoming request targets the object versioning endpoint, the storage access layer inspects the request for a direct bucket-policy grant. If no direct grant is present, the authorization flow prematurely falls back to evaluating a generic s3:ListBucket permission check.\nDuring this fallback evaluation, the authorization handler performs an early return before reaching the critical policy_allowed execution path. As a result of this premature return, downstream security functions such as deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets are completely bypassed. These security controls are specifically designed to inhibit unauthorized anonymous access to data plane operations when public access blocking mechanisms are enabled by operators.\nThe attack flow begins when an unauthenticated adversary crafts a malicious HTTP GET request targeting the vulnerable endpoint using the syntax GET /<bucket>?versions=. Upon receipt, the RustFS server processes the request through the flawed access module in rustfs/src/storage/access.rs. Because the request lacks explicit authentication credentials and attempts to list object versions, it triggers the vulnerable fallback mechanism. The authorization engine evaluates the s3:ListBucket permission, validates it against legacy or overly permissive configurations, and prematurely returns a success determination without executing the stricter public-access restriction layers.\nConsequently, the server processes the request and returns a complete list of object versions and associated metadata to the unauthorized client. This occurs despite the bucket operator having previously configured public-access controls to restrict such operations. The post-exploitation impact is restricted to information disclosure, specifically the enumeration of object versions, keys, and metadata identifiers, which could subsequently aid further targeting or reconnaissance against stored data assets. Authentication and privilege requirements are minimal, as the attack is fully exploitable by anonymous network actors without valid credentials."
}