GHSA-333v-68xh-8mmq RustFS's RPC signature verification logs shared secret

• crates.io rustfs: >= 1.0.0-alpha.1, < 1.0.0-alpha.80 → fixed in 1.0.0-alpha.80

Summary Invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. Details In `crates/ecstore/src/rpc/http_auth.rs:115-122` , the invalid signature branch logs sensitive data: ```rs if signature != expected_signature { error!( "verify_rpc_signature: Invalid signature: secret {}, url {}, method {}, timestamp {}, signature {}, expected_signature {}", secret, url, method, timestamp, signature, expected_signature ); return Err(std::io::Error::other("Invalid signature")); } ``` This log line includes `secret` and `expected_signature`, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. PoC 1. Run RustFS with error logging enabled. 1. Send a request with an invalid signature: ``` ts=$(date +%s) curl -v \ -H "x-rustfs-timestamp: $ts" \ -H "x-rustfs-signature: invalid-signature" \ "http://localhost:9000/rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1" ``` 1. Observed output: ``` HTTP 403 AccessDenied: Invalid signature verify_rpc_signature: Invalid signature: secret rustfsadmin, url /rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1, method GET, timestamp 1767852115, signature invalid-signature, expected_signature oisNxNRTb80GXf97s/PGdScJzu8QB9Oxs+uOwf8RiK8= ``` Impact • Exposes the shared RPC HMAC secret to log readers. • Enables attackers with log access to forge valid RPC signatures and make unauthorized RPC calls.