RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
References 4
https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d
security-advisories@github.com
https://github.com/rustfs/rustfs/pull/5648
security-advisories@github.com
https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1
security-advisories@github.com
https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f
security-advisories@github.com