{"id":153280,"date":"2026-01-03T23:11:59","date_gmt":"2026-01-03T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa"},"modified":"2026-01-03T23:11:59","modified_gmt":"2026-01-03T21:11:59","slug":"v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","title":{"rendered":"I RustFS er der identificeret en forudbestemt adgangstoken i koden.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I projektet RustFS, der udvikler en S3-kompatibel distribueret objektlager skrevet i Rust, er der blevet opdaget en s\u00e5rbarhed (CVE-2025-68926), der minder om en bagd\u00f8r. Problemet er for\u00e5rsaget af tilstedev\u00e6relsen af en h\u00e5rdkodet adgangstoken i koden, der muligg\u00f8r tilslutning til en netv\u00e6rkstjeneste via gRPC-protokollen ved at angive v\u00e6rdien \"rustfs rpc\" i headeren \"authorization\". Tokenet var til stede i b\u00e5de server- og klientkoden. Problemet er kategoriseret med en kritisk faregrad (9,8 ud af 10). <\/p>\n

En angriber med adgang til gRPC-netv\u00e6rksporten kunne bruge den angivne token til at udf\u00f8re privilegerede operationer p\u00e5 lageret, herunder sletning af data, manipulation med brugernes legitimationsoplysninger og \u00e6ndring af klyngens indstillinger. Som standard accepterer RustFS gRPC-anmodninger p\u00e5 TCP-port 9000 p\u00e5 alle netv\u00e6rksgr\u00e6nseflader. S\u00e5rbarheden er blevet l\u00f8st i udgivelsen RustFS 1.0.0-alpha.77. grpcurl -plaintext -H 'authorization: rustfs rpc' \\ -d '{\"access_key\": \"admin\"}' \\ localhost:9000 node_service.NodeService\/LoadUser grpcurl -plaintext -H 'authorization: rustfs rpc' \\ -d '{\"volume\": \"config\", \"path\": \"backdoor.sh\", \"buf\": \"...\"}' \\ localhost:9000 node_service.NodeService\/WriteAll
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 RustFS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0435 \u0441 S3 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-68926), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u0431\u044d\u043a\u0434\u043e\u0440. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0436\u0451\u0441\u0442\u043a\u043e \u043f\u0440\u043e\u0448\u0438\u0442\u043e\u0433\u043e \u0432 \u043a\u043e\u0434\u0435 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 gRPC, \u0443\u043a\u0430\u0437\u0430\u0432 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 «authorization» \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 «rustfs rpc». \u0422\u043e\u043a\u0435\u043d \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u043a\u043e\u0434\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153280","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Der er opdaget en foruddefineret adgangstoken i koden til RustFS | ProHoster","description":"I projektet RustFS, der udvikler et S3-kompatibelt distribueret objektlager skrevet i Rust, er der opdaget en s\u00e5rbarhed (CVE-2025-68926), der minder om en bagd\u00f8r.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RustFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0435\u0434\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0442\u043e\u043a\u0435\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 RustFS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0435 \u0441 S3 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-68926), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u0431\u044d\u043a\u0434\u043e\u0440.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-03T21:11:59+00:00","article:modified_time":"2026-01-03T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153280","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 14:00:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:00:20","updated":"2026-01-20 14:00:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/153280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=153280"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/153280\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=153280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=153280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=153280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}