CyberRota Analysis
AI-GeneratedA critical vulnerability exists in SeaweedFS prior to version 4.24, where the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication if the jwt.filer_signing.key is unset. This allows unauthorized clients to invoke IAM RPCs, potentially granting them S3 administrative control and compromising the integrity of the storage system. Organizations using affected versions should prioritize upgrading to 4.24 or later to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.