Description
SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
seaweedfs seaweedfs
Default version status: unaffected
0 to < 4.34affected
pkg:golang/github.com/seaweedfs/seaweedfsReferences
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 ↗
- https://github.com/seaweedfs/seaweedfs/pull/9931 ↗
- https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9 ↗
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv ↗
- https://github.com/geo-chen/oss/blob/main/seaweedfs.md ↗
- https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys ↗