CVE-2025-68705

Executive Summary

CVE-2025-68705 is a path traversal vulnerability in RustFS, a distributed object storage system built in Rust. The flaw exists in the /rustfs/rpc/read_file_stream endpoint, affecting versions from 1.0.0-alpha.13 to 1.0.0-alpha.78. An attacker can exploit this to read arbitrary files outside the intended storage directory, potentially leading to unauthorized access to sensitive data, configuration files, or system files. The vulnerability has been patched in version 1.0.0-alpha.79, but no public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

RustFS is a Rust-based project, typically distributed via source code or binary releases. Users should verify the integrity of their RustFS installation and ensure they are using a patched version. The Rust ecosystem uses cargo for package management; however, RustFS is not a typical library but a standalone system. Supply chain risks include compromised builds or dependencies, though no specific advisories have been issued.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the vulnerability type (path traversal), a reasonable estimate would be:

• Attack Vector (AV): Network (N) – the endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – no write capability.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Base Score: 7.5 (High)

Threat Level: High – due to the potential for unauthorized data access without authentication.

Deep Dive & Mechanics

The vulnerability resides in the /rustfs/rpc/read_file_stream RPC endpoint. This endpoint is designed to read files from the object storage system. The flaw is a classic path traversal (directory traversal) vulnerability, where user-supplied input (likely a file path or identifier) is not properly sanitized. An attacker can inject ../ sequences to escape the intended storage directory and read arbitrary files on the server's filesystem.

Root Cause: Insufficient validation of the file path parameter in the read_file_stream function. The code likely constructs a file path by concatenating a base directory with user input without checking for traversal sequences.

Attack Vector: An attacker sends a crafted HTTP request to the endpoint with a malicious path, such as ../../etc/passwd.

Impact: Successful exploitation allows reading any file the RustFS process has access to, including:

• Configuration files (e.g., database credentials, API keys)
• System files (e.g., /etc/shadow, /etc/passwd)
• Application source code
• Other sensitive data

Vulnerable vs. Patched Code

Since no specific code snippets are provided, the following is a hypothetical example based on common path traversal patterns.

Vulnerable Code (Rust):

// Vulnerable: Direct concatenation without sanitization
fn read_file_stream(path: &str) -> Result<Vec<u8>, Error> {
    let base = "/var/rustfs/data/";
    let full_path = format!("{}{}", base, path);
    std::fs::read(full_path)
}

Patched Code (Rust):

// Patched: Canonicalize and validate path
use std::path::Path;

fn read_file_stream(path: &str) -> Result<Vec<u8>, Error> {
    let base = Path::new("/var/rustfs/data/");
    let user_path = Path::new(path);
    // Canonicalize to resolve any '..' components
    let full_path = base.join(user_path);
    let canonical = full_path.canonicalize()?;
    // Ensure the resolved path is still within the base directory
    if !canonical.starts_with(base) {
        return Err(Error::new("Path traversal detected"));
    }
    std::fs::read(canonical)
}

Key Differences:

• The patched version uses canonicalize() to resolve symbolic links and .. sequences.
• It then checks that the resolved path starts with the intended base directory.
• This prevents any traversal outside the allowed storage area.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable RustFS instance (version 1.0.0-alpha.13 to 1.0.0-alpha.78).
• Network access to the /rustfs/rpc/read_file_stream endpoint.

Exploitation Steps:

1. Identify the endpoint: POST /rustfs/rpc/read_file_stream
2. Craft a request with a malicious path parameter:

   {
     "path": "../../etc/passwd"
   }
   

3. Send the request using curl:

   curl -X POST http://target:port/rustfs/rpc/read_file_stream \
     -H "Content-Type: application/json" \
     -d '{"path":"../../etc/passwd"}'
   

4. If successful, the response will contain the contents of /etc/passwd.

Advanced Techniques:

• Use URL encoding to bypass simple filters: ..%2f..%2fetc%2fpasswd
• Try different traversal depths: ../../../etc/shadow
• Attempt to read application configuration files: ../../config.toml

Blue Team (Defensive)

Detection:

• Monitor for requests containing ../ or ..\\ in the path parameter.
• Look for unusual file paths in logs, especially those referencing system files like /etc/passwd, /etc/shadow, or /proc/self/environ.
• Use Web Application Firewall (WAF) rules to block path traversal patterns.

Hunting:

• Search logs for the read_file_stream endpoint with paths containing .. or absolute paths.
• Check for outbound data transfers that may indicate exfiltration of sensitive files.

Lab Setup:

• Deploy a vulnerable RustFS instance in a sandboxed environment.
• Use tools like Burp Suite or Postman to send crafted requests.
• Monitor logs and network traffic to observe the attack.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /rustfs/rpc/read_file_stream with path parameters containing ../ or ..\\.
  • Unusual file paths in request bodies, such as /etc/passwd, /etc/shadow, /proc/self/environ, or application config files.
• File System IOCs:
  • Unexpected access to files outside the RustFS data directory.
  • Presence of sensitive files in logs or error messages.
• Log IOCs:
  • Error messages indicating failed path traversal attempts (e.g., "Path traversal detected" if patched).
  • Repeated requests to the same endpoint with varying traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_68705_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against RustFS read_file_stream endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-68705"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/rustfs/rpc/read_file_stream"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: RustFS Path Traversal Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects path traversal attempts against RustFS read_file_stream endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: rustfs
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rustfs/rpc/read_file_stream'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of '..' in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68705 RustFS Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/rustfs/rpc/read_file_stream"; http_uri; content:"../"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade RustFS to version 1.0.0-alpha.79 or later.
2. If upgrade is not possible, restrict network access to the /rustfs/rpc/read_file_stream endpoint using firewall rules or reverse proxy configurations.
3. Implement input validation at the application layer to reject paths containing ../ or ..\\.

Long-term Measures:

• Code Review: Ensure all file path operations use canonicalization and path validation.
• Least Privilege: Run RustFS with minimal filesystem permissions to limit the impact of a successful exploit.
• Monitoring: Deploy the detection rules above to alert on exploitation attempts.
• WAF Rules: Add rules to block path traversal patterns in HTTP requests.

Patch Details:

• The vulnerability is fixed in version 1.0.0-alpha.79. Users should update to this version immediately. No specific commit or patch file has been provided, but the fix likely involves proper path sanitization as described in the "Vulnerable vs. Patched Code" section.

Report generated by Valters IT DevSecOps & CTI Framework