Go · github.com/seaweedfs/seaweedfs
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as:
GET /bucket-A/../evil-bucket/key
is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket.
The captured path variables were never validated for traversal segments before reaching the handlers, so bucket isolation depended on downstream checks rather than on the path itself.
enableAuth=false): direct cross-bucket read and write. An object key containing .. resolves to and operates on a different bucket than the one named in the request path.enableAuth=true): an authorization confused-deputy. IAM evaluates the policy against the mux {bucket} variable (bucket-A) in iam.authRequestWithAuthType, while the I/O is performed against the traversed target (evil-bucket). A principal authorized for one bucket can therefore reach objects in another bucket it has no grant for. This breaks tenant isolation.The same class of traversal applies to the Iceberg REST catalog's {prefix}, {namespace}, and {table} path variables.
%2e%2e-encoded and ..\ (backslash) variants are equivalent, because gorilla/mux URL-decodes captured variables and NormalizeObjectKey folds \ to / before the path is used.
weed s3, and the S3 endpoint embedded in weed server)All releases prior to 4.30.
4.30 and later.
With a bucket evil-bucket containing secret.txt, and a caller that only has (or needs no) access to bucket-A:
GET /bucket-A/../evil-bucket/secret.txt HTTP/1.1
Host: <gateway>
The response returns the contents of evil-bucket/secret.txt. The encoded form GET /bucket-A/%2e%2e/evil-bucket/secret.txt behaves identically.
Upgrade to SeaweedFS 4.30 or later. The fix adds a validation middleware to both gateway routers that rejects any captured path variable containing a . or .. segment, a NUL byte, an embedded slash/backslash in single-segment slots, or an empty captured value, before any handler runs.
For deployments that cannot upgrade immediately, place a reverse proxy in front of the gateway that normalizes the request path and rejects requests whose path contains .., %2e%2e, or backslash sequences. Note that disabling auth removes the only remaining barrier, so do not rely on enableAuth=false deployments being protected by anything.
dd1b428)Reported responsibly by Denis Abashkin (@dadbravo).
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.