1 line
3.1 KiB
JSON
1 line
3.1 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-vcwh-pff9-64cc","published":"2026-01-08T20:36:17Z","modified":"2026-02-03T03:16:06.066149Z","aliases":["CVE-2026-22042"],"summary":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","details":"### Summary\n\nThe `ImportIam` admin API validates permissions using **`ExportIAMAction`** instead of **`ImportIAMAction`**, allowing a principal with *export-only* IAM permissions to perform *import* operations. Since importing IAM data performs privileged **write** actions (creating/updating users, groups, policies, and service accounts), this can lead to **unauthorized IAM modification and privilege escalation**.\n\n---\n\n### Details\n\nIn `ImportIam`, the authorization check is implemented as follows:\n\n```rust\nvalidate_admin_request(\n &req.headers,\n &cred,\n owner,\n false,\n vec![Action::AdminAction(AdminAction::ExportIAMAction)],\n).await?;\n```\n\nHowever, this code resides in the **Import IAM** operation (`struct ImportIam {}`), which performs **state-changing IAM writes**.\n\nThe expected behavior is to validate against **`AdminAction::ImportIAMAction`** (or an equivalent import-specific admin action), not `ExportIAMAction`.\n\n---\n\n### PoC\n\n**Prerequisites**\n\n1. A RustFS deployment with IAM enabled.\n2. An IAM user or role that has **Export IAM** permission but **does not** have Import IAM or full admin permissions.\n3. Access credentials for that user.\n\n**Steps**\n\n1. Create or obtain an IAM principal with permission equivalent to:\n\n ```\n AdminAction::ExportIAMAction\n ```\n\n and without Import IAM privileges.\n\n2. Prepare a valid IAM import ZIP archive containing, for example:\n\n * A new policy granting administrative permissions\n * A user or service account bound to that policy\n\n3. Send a request to the Import IAM endpoint (the same endpoint handled by `ImportIam::call`), authenticating with the export-only credentials.\n\n4. Observe that:\n\n * The request passes authorization.\n * IAM entities from the archive are created or modified successfully.\n\n**Expected Result**\n\n* The request should be rejected with an authorization error (e.g., AccessDenied).\n\n**Actual Result**\n\n* The request succeeds, and IAM state is modified.","affected":[{"package":{"name":"rustfs","ecosystem":"crates.io","purl":"pkg:cargo/rustfs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-alpha.79"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-vcwh-pff9-64cc/GHSA-vcwh-pff9-64cc.json"}}],"references":[{"type":"WEB","url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22042"},{"type":"PACKAGE","url":"https://github.com/rustfs/rustfs"}],"database_specific":{"cwe_ids":["CWE-285"],"github_reviewed":true,"github_reviewed_at":"2026-01-08T20:36:17Z","nvd_published_at":"2026-01-08T15:15:45Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}]} |