The RustFS project, which develops a distributed object storage compatible with S3 and written in Rust, has revealed a vulnerability (CVE-2025-68926) resembling a backdoor. The issue arises from a hardcoded access token in the code that allows connection to a network service via the gRPC protocol, specifying the header "authorization" with the value "rustfs rpc". The token was present in both the server and client code. The problem has been assigned a critical severity level (9.8 out of 10).
An attacker with access to the gRPC network port could use the specified token to perform privileged operations on the storage, including data deletion, manipulation of user credentials, and changing cluster settings. By default, RustFS accepts gRPC requests on TCP port 9000 on all network interfaces. The vulnerability has been fixed in RustFS release 1.0.0-alpha.77. grpcurl -plaintext -H 'authorization: rustfs rpc' \ -d '{"access_key": "admin"}' \ localhost:9000 node_service.NodeService/LoadUser grpcurl -plaintext -H 'authorization: rustfs rpc' \ -d '{"volume": "config", "path": "backdoor.sh", "buf": "…"}' \ localhost:9000 node_service.NodeService/WriteAll
Source: opennet.ru
