Chocapikk/CVE-2025-68926

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based exploit for CVE-2025-68926 that connects to a RustFS gRPC service, authenticates using the hardcoded token 'rustfs rpc', and performs privileged operations including server information disclosure, disk discovery, volume listing, and recursive file system exploration with file content retrieval.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Go-based proof-of-concept exploit for CVE-2025-68926. The code connects to a RustFS gRPC service using a hardcoded token, then enumerates disks, volumes, directories, and reads file contents. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The exploit performs only the advertised vulnerability demonstration.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesGo
Target softwareRustFS
Attack typesauthentication bypassinformation disclosuredata access
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the hardcoded token vulnerability to authenticate and perform privileged operations (ServerInfo, ListVolumes, ListDir, ReadAll) on a target RustFS instance. It is self-described as an 'Exploit' and includes a main function that executes the full exploitation chain when run with a target host and port.

main.go:496-532main.go:506README.md:5

Requirements

  • Network access to a vulnerable RustFS gRPC service portmain.go:121-123
  • Knowledge of the hardcoded token 'rustfs rpc'main.go:27

Observed behavior

  • Establishes an unencrypted gRPC connection to the target host and portmain.go:121-123
  • Authenticates to the gRPC service by setting the 'authorization' metadata header to the hardcoded token 'rustfs rpc'main.go:128main.go:179
  • Calls the ServerInfo RPC method to retrieve and decode server properties (MsgPack-decoded base64 data)main.go:208-237
  • Discovers available disks from the ServerInfo response or falls back to a default listmain.go:239-275
  • Lists volumes on each discovered disk via the ListVolumes RPC methodmain.go:305-335
  • Recursively explores directories on each volume using ListDir and reads file contents via ReadAll, printing JSON data or file sizesmain.go:386-439main.go:362-384
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credential
rustfs rpcThe exploit uses the publicly known hardcoded token to authenticate to the target gRPC service, consistent with the CVE description.main.go:27main.go:128main.go:179
Exploit Behavior
gRPC service enumeration and file readThe exploit calls ServerInfo, ListVolumes, ListDir, and ReadAll RPC methods to discover and exfiltrate data from the target. This matches the stated CVE impact of unauthenticated file read/write operations.main.go:208-237main.go:305-335main.go:337-360main.go:362-384
Review boundaries

What the analysis did not establish

  • Two files (docker-compose.yml and Dockerfile) are omitted from the evidence, so the lab setup referenced in the README cannot be fully verified.
  • The evidence does not include the actual execution output or confirmation that the exploit was tested against a live target.
  • Two files (docker-compose.yml and Dockerfile) were omitted from the text evidence and not reviewed; they may contain additional configuration but are not expected to alter the backdoor assessment.
  • Binary files were not present in the evidence.
  • The review is limited to static analysis of the provided source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-68926Compose · mixed

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a RustFS server (version 1.0.0-alpha.76) with a helper service to fix volume permissions. The README describes it as a lab for CVE-2025-68926, a hardcoded gRPC authentication token vulnerability.

docker-compose.yml:1-78README.md:1-41

Lab assessment

Vulnerability lab

The README explicitly states the environment is for CVE-2025-68926, describes the vulnerability, and provides setup and usage instructions for an exploit. The Docker Compose file sets up the vulnerable RustFS service.

README.md:1-41
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

rustfs

vulnerable target service

RustFS server version 1.0.0-alpha.76, built from Dockerfile.source, exposing S3 API on host port 19010 and console on 19011. Configured with hardcoded access/secret keys and TLS path. Uses named volumes for data and logs.

docker-compose.yml:4-53

volume-permission-helper

one-time setup helper

An Alpine container that runs once to change ownership of the data and log volumes to UID/GID 10001, then exits. It does not stay running.

docker-compose.yml:55-70
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68926

Supported by supplied evidence

The README describes a hardcoded gRPC authentication token in RustFS versions < 1.0.0-alpha.77, and the Docker Compose file uses image rustfs/rustfs:1.0.0-alpha.76, which falls within the affected range. The exploit code (main.go) and dependencies (go.mod) are present to exercise the vulnerability.

README.md:1-41docker-compose.yml:7
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Go toolchain and dependencies must be installed to build the exploit (go mod download, go build).README.md:20-24
  • Docker and Docker Compose must be available to launch the lab environment.README.md:26
  • The Dockerfile.source referenced in the build context must exist to build the RustFS image, though the compose file also specifies a pre-built image.docker-compose.yml:6-8

Evidence-described exercise path

  1. Install Go dependencies and build the exploit binary.README.md:20-24
  2. Start the vulnerable RustFS lab environment with docker compose up -d.README.md:26
  3. Run the exploit against the exposed service, e.g., ./exploit localhost 19010.README.md:30-33
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The RustFS service is exposed on host ports, which is expected for a lab. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended target. The volume-permission-helper only fixes ownership and exits.

docker-compose.yml:1-78README.md:1-41
Review boundaries

What the analysis did not establish

  • Dockerfile.source is missing from the evidence, so the exact build steps for the RustFS image are unknown.
  • main.go (the exploit source) is present in the file inventory but its content is not included in the evidence, so the exact exploit behavior is uninspected.
  • The go.sum file is present but only provides dependency hashes, not behavioral evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1