RustFS Presigned POST Upload Policy Bypass Vulnerability Allowing Unauthorized File Uploads

A vulnerability exists in RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82, where the application fails to validate policy conditions in presigned POST uploads. This oversight allows attackers to bypass constraints related to content length, object key prefixes, and content types. As a result, unauthorized file uploads can occur, including files that exceed size limits, files uploaded to arbitrary object keys, and content-type spoofing. These actions could lead to storage exhaustion, unauthorized access to data, and bypassing of security measures. The issue has been fixed in version 1.0.0-alpha.83.

Impact

Exploitation of this vulnerability allows for a complete bypass of server-enforced upload policies, which could lead to storage exhaustion, unauthorized data access or modification, and content-type spoofing. Such actions could disrupt service availability and undermine the security model that applications relying on RustFS for S3-compatible storage must maintain.

Remediation

Users can upgrade to RustFS version 1.0.0-alpha.83 or later to address this vulnerability.