Description

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T19:16:54.907Z",
  "pubdate": "2026-08-25T19:16:54.907Z",
  "executiveSummary": "The Alluxio S3 REST proxy contains a critical vulnerability where AWS Signature Version 4 (SigV4) signatures are not cryptographically verified in the default configuration. This flaw constitutes an authentication bypass vulnerability, enabling unauthenticated remote attackers to impersonate arbitrary users, including privileged service accounts.\nBy manipulating the Authorization header and providing an arbitrary username, an attacker can bypass identity validation mechanisms. The impact is severe, as successful exploitation grants the attacker full access to the underlying storage layer, allowing for the unauthorized reading, writing, and deletion of sensitive data.\nThis vulnerability poses a significant risk to data integrity, confidentiality, and availability. It affects the S3 REST proxy component of Alluxio, requiring no prior authentication or specialized credentials for exploitation. Organizations relying on Alluxio's S3-compatible interface are susceptible to unauthorized data manipulation and potential supply chain compromise if the proxy is exposed to a network reachable by malicious actors.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the Alluxio S3 REST proxy to enforce cryptographic validation of the AWS Signature Version 4 (SigV4) authentication protocol. While the proxy is designed to process S3 requests and interpret the Authorization header for identity management, the implementation relies on the presence of the header for user identification without verifying the digital signature that validates the request's integrity and authenticity.\nDuring a standard AWS SigV4 request, the client computes a signature based on the request parameters and a secret access key. The Alluxio proxy incorrectly treats the user identity parsed from this header as a trusted claim rather than a verifiable statement. Because the proxy skips the server-side verification logic—which should compare the provided signature against a locally computed HMAC—it accepts the claim of identity at face value.\nThe exploitation flow is straightforward: An attacker crafts an HTTP request conforming to the S3 API specification. In the Authorization header, the attacker specifies a target identity (e.g., a high-privilege service account) within the 'Credential' field. Since the proxy performs no cryptographic check, it assumes the request originated from the specified user. The attacker sends this request to the Alluxio S3 REST proxy endpoint, which processes the request with the context of the spoofed identity.\nUpon successful spoofing, the attacker gains the full privileges associated with the impersonated account within the Alluxio filesystem. This enables the attacker to interact with the storage back-end as if they were a legitimate user, facilitating unauthorized read, write, and deletion operations. The vulnerability is systemic to the proxy component and does not require complex payloads or heap manipulation, as the logical failure exists in the core authentication routine.\nThis issue exposes the system to unauthorized data exfiltration, arbitrary file injection, and destructive operations on data stored within the Alluxio namespace. The lack of signature enforcement effectively turns the S3 interface into an open gateway for any network-proximate actor to exercise control over the storage infrastructure without needing valid AWS credentials."
}