RustFS CVE-2025-68705

Exploitation requires a request to the /rustfs/rpc/read_file_stream endpoint carrying a valid x-rustfs-signature (HMAC-SHA256 over '{url}|{method}|{timestamp}') and x-rustfs-timestamp, computed with the RPC shared secret from RUSTFS_SECRET_KEY - the POC succeeded using the default secret 'rustfsadmin'. The attacker supplies disk and volume parameters plus a traversal path (e.g. ../../../../etc/passwd) and must know the target file's size for the length parameter. LIMITING FACTORS: the internal RPC endpoint must be network-reachable, and the attacker must know or guess the RPC secret (so changing the default secret and restricting RPC exposure materially reduces risk); affected only on versions 1.0.0-alpha.13 through 1.0.0-alpha.78.

Signals conflict and net out to a lower real-world priority than the 8.8 score suggests. The official CVSS:4.0 vector asserts PR:N (unauthenticated) with VC:H/VI:H, but the GHSA proof-of-concept directly contradicts this: the /rustfs/rpc/read_file_stream endpoint requires a valid HMAC-SHA256 signature computed over the request using the RPC shared secret (RUSTFS_SECRET_KEY), so an attacker must possess or guess that secret before path traversal is reachable - the PR:N metric appears to understate authentication and should be verified with the vendor. Exploitation status is 'publicly available exploit code exists' (POC in the GHSA, with working /etc/passwd read) - this is NOT active exploitation; the CVE is absent from CISA KEV. EPSS is only 0.04% (13th percentile), consistent with a niche, newly-released product and a secret-gated attack surface rather than mass exploitation. The source-code evidence corroborates the root cause (PathBuf::join without canonicalization at local.rs:1791, fixed by has_bad_path_component/is_valid_object_prefix validation in alpha.79). Net: a confirmed, patched, real path-traversal flaw with a working POC, but gated by RPC secret knowledge, low EPSS, no KEV, and a small deployment base - moderate priority, patch on normal cadence unless the RPC secret is default ('rustfsadmin' per POC) or exposed.

An attacker who knows or guesses the RustFS RPC secret (the POC used the default 'rustfsadmin') crafts a signed GET request to /rustfs/rpc/read_file_stream with path=../../../../etc/passwd, bypassing the missing path sanitization and reading arbitrary host files such as /etc/passwd, /etc/hosts, and /etc/hostname. A public proof-of-concept demonstrating this read exists in the GitHub Security Advisory. Because the vector is network-based with low complexity, exploitation is trivial once the shared RPC secret is obtained.