RustFSでWebDAV・FTP・SFTP経由のバケットポリシー回避により保護データが改ざんされるおそれ

Summary

RustFS enforces bucket policies and policy condition keys only on the S3 API authorization path. The alternate file protocol listeners (WebDAV, FTP, FTPS, SFTP) authorize every operation only against IAM identity policies with a hard-coded empty condition map, and their storage backend calls the s3s S3 handler methods directly without passing through the s3s S3Access layer where authorize_request runs. An attacker who holds any valid access key pair can therefore read, overwrite, and delete objects that a bucket policy explicitly denies to them, and can read objects whose IAM Deny is conditioned on request attributes such as aws:SourceIp, by simply using WebDAV, FTP, or SFTP instead of S3. Affected component: rustfs-protocols authorization gateway and the rustfs protocol storage client. Required privilege: a valid access key pair (IAM user or service account) and network reachability to an enabled protocol listener. Ultimate consequence: unauthorized disclosure and tampering of protected object data.

Novelty classification: Historical-related variant. Prior advisories GHSA-3g29-xff2-92vp and GHSA-g3vq-vv42-f647 covered entirely missing IAM authorization on FTP/FTPS handlers and were fixed by adding the shared gateway used today. This report describes a distinct gap in the same trust boundary. The duplicate-check outcome is below.

Details

Tested revision: rustfs main commit 1e7065101d7de4ebacabd249db5b4debbf5baa68 (crate version 1.0.1, 84 commit…