Rucio URL-signing endpoint authorization bypass exposes cloud storage
Any logged-in user can delete or change cloud storage files.
Summary
The Rucio scientific data management framework has an authorization bypass in its URL-signing API. A logged-in low-privilege user can obtain signed URLs to read, write, or delete objects in cloud storage.
Affected when
- RSE backed by S3, GCS, or Swift cloud storage
- any valid auth token, even low-privilege
What to do
Update to the fixed version for your release line: 35.9.0, 38.6.0, or 41.0.0rc1.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen