CVE-2023-46738

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CubeFS Security Feature Issue Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security signature issue vulnerability exists in versions prior to CubeFS 3.3.1 that stems from the use of an insecure random string generator to generate user-specific sensitive keys. An attacker can escalate privileges by...

CubeFS Security Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security vulnerability exists in CubeFS versions prior to 3.3.1 that stems from improper handling of incoming HTTP requests. An attacker can exploit the vulnerability to control the amount of memory allocated by an ObjectNo...

CubeFS Security Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security vulnerability exists in CubeFS versions prior to 3.3.1, which stems from leaking configuration keys in plaintext format in logs. An attacker exploited the vulnerability to read sensitive data from logs to escalate...

CVE-2023-46742: Insertion of Sensitive Information into Log File

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

PT-2024-13374

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1 Description A vulnerability was found in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root cause of the issue was that CubeFS use...

CubeFS Log Information Disclosure Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A log information disclosure vulnerability exists in CubeFS versions prior to 3.3.1, which stems from disclosing user keys and access keys in logs...

CVE-2023-46740: Use of Insufficiently Random Values

CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string...

CVE-2023-46739: Observable Discrepancy

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS...

CVE-2023-46741: Exposure of Sensitive Information to an Unauthorized Actor

CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys...

PT-2024-13376

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1 Description A vulnerability was found in CubeFS that could allow users to read sensitive data from the logs, which could allow them to escalate privileges. CubeFS leaks configuration keys in plaintext format in t...

PT-2024-13375

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1 Description CubeFS is an open-source cloud-native file storage system that used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. Thi...

PT-2024-13373

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1 Description A security issue was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests, crashing the ObjectNode and denying other users from using it. The root caus...

CubeFS Security Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security vulnerability exists in CubeFS versions prior to 3.3.1. An attacker can steal user passwords by exploiting the vulnerability...

CVE-2023-46738: Allocation of Resources Without Limits or Throttling

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

PT-2024-13377

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1 Description CubeFS is an open-source cloud-native file storage system that was found to leak users' secret keys and access keys in the logs in multiple components. When CubeFS creates new users, it leaks the user...

The vulnerability of the cloud data storage system CubeFS, related to the improper assignment of permissions for critical resources, allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the cloud data storage system CubeFS is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

Privilege Escalation

CubeFS is vulnerable to Privilege Escalation. The vulnerability is due to not restricting/restraining the secrets which are accessed by DaemonSet of CubeFS. This can lead to an attacker controlling a worker node to make a cluster-level privilege escalation by leveraging the pod controlled by...

CubeFS allows Kubernetes cluster-level privilege escalation

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret...