CyberRota Analysis
AI-GeneratedSeaweedFS versions prior to 4.24 are vulnerable due to improper authorization checks in the filer server, allowing a scoped JWT to access sibling paths, which can lead to unauthorized cross-tenant data access. This vulnerability poses a significant risk to data confidentiality and integrity, making it critical for organizations using SeaweedFS to prioritize upgrading to version 4.24 or later. Users managing multi-tenant environments should take immediate action to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.