CyberRota Analysis
AI-GeneratedRustFS versions prior to 1.0.0-beta.12 are vulnerable to an authorization bypass in the FTPS MKD command, enabling authenticated users who lack permission to create S3 buckets to do so. This flaw could lead to unauthorized resource creation, potentially impacting storage management and security. Organizations using affected versions should prioritize updating to the fixed version to mitigate the risk of unauthorized bucket creation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12.