RustFS Console Stored XSS Vulnerability Leading to Administrative Account Takeover

The RustFS Console improperly validates the content type during file preview, rendering untrusted files in an iframe. This allows injection of arbitrary JavaScript, accessing localStorage for S3 credentials, leading to administrative takeover.

The PoC demonstrates a critical flaw where malicious PDFs can execute scripts, proving the need for strict content validation and separation of concerns between file delivery and management interfaces.

{'monitoring': 'Monitor for iframe activities and unexpected JavaScript execution in the preview modal. Look for异常访问 localStorage 的日志和流量 spikes from the preview feature.', 'headers': 'Implement CSP headers to block script execution within iframes.', 'logging': 'Log access attempts to localStorage and unusual file requests.'}

{'content_validation': 'Strictly validate file types before rendering in iframes. Use MIME type checks and consider file hashes.', 'origin_separation': 'Enforce separate origins for S3 object delivery and management console, possibly using subdomains.', 'credential_storage': 'Avoid storing sensitive credentials in localStorage. If necessary, encrypt them and use secure storage mechanisms.'}

{'likelihood': 'High', 'threat_interest': 'High', 'reasoning': 'Critical severity, potential for credential theft, and system compromise make this a high-risk target for attackers seeking to compromise RustFS infrastructure.'}