Summary
SeaweedFS routes requests signed with SigV4 service s3tables to the S3Tables
management API. Authorization on that path collapsed account-less S3 identities
into the shared admin account and failed open, so a user holding only ordinary
S3 Read credentials — and no S3Tables-specific permission — could invoke
S3Tables management operations such as GET /buckets and enumerate
administrator-owned table bucket inventory (names and ARNs). The same handler
backs the Iceberg REST catalog, which was affected by the same flaw.
Impact
An authenticated low-privileged S3 user can cross the boundary between ordinary
S3 object access and S3Tables management. Confirmed impact is disclosure of
administrator-owned table bucket inventory (bucket names and ARNs); in shared or
multi-tenant deployments this can reveal tenant naming and operational structure.
Affected versions
SeaweedFS >= 4.08, < 4.34 (the S3Tables management API was introduced in 4.08).
Patched versions
Fixed in 4.34 (#9961). Administrator status is now decided by the
ACTION_ADMIN capability rather than by a collapsed admin account id, S3Tables
authorization no longer defaults to allow, and the tautological ListTableBuckets
gate was removed. Related hardening of the same root cause landed in #9962,
#9963, and #9971.
Workaround
No configuration workaround — upgrade to 4.34 or later.
Credit
Reported by TA-MU-TA.
References
TA-MU-TA Finder
Summary
SeaweedFS routes requests signed with SigV4 service
s3tablesto the S3Tablesmanagement API. Authorization on that path collapsed account-less S3 identities
into the shared
adminaccount and failed open, so a user holding only ordinaryS3
Readcredentials — and no S3Tables-specific permission — could invokeS3Tables management operations such as
GET /bucketsand enumerateadministrator-owned table bucket inventory (names and ARNs). The same handler
backs the Iceberg REST catalog, which was affected by the same flaw.
Impact
An authenticated low-privileged S3 user can cross the boundary between ordinary
S3 object access and S3Tables management. Confirmed impact is disclosure of
administrator-owned table bucket inventory (bucket names and ARNs); in shared or
multi-tenant deployments this can reveal tenant naming and operational structure.
Affected versions
SeaweedFS
>= 4.08, < 4.34(the S3Tables management API was introduced in 4.08).Patched versions
Fixed in 4.34 (#9961). Administrator status is now decided by the
ACTION_ADMINcapability rather than by a collapsedadminaccount id, S3Tablesauthorization no longer defaults to allow, and the tautological ListTableBuckets
gate was removed. Related hardening of the same root cause landed in #9962,
#9963, and #9971.
Workaround
No configuration workaround — upgrade to 4.34 or later.
Credit
Reported by TA-MU-TA.
References