CVE-2025-68671
📋 TL;DR
LakeFS's S3 gateway fails to validate timestamps in authenticated requests, allowing replay attacks. Attackers who capture valid signed requests can replay them indefinitely until credentials are rotated. This affects all lakeFS deployments using the S3 gateway prior to version 1.75.0.
💻 Affected Systems
- lakeFS
📦 What is this software?
Lakefs by Lakefs
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized data access, modification, or deletion in object storage repositories through replayed administrative or data manipulation requests.
Likely Case
Unauthorized data access or modification by replaying captured S3 API requests, potentially leading to data integrity issues.
If Mitigated
Limited impact if network monitoring detects unusual request patterns and credentials are rotated frequently.
🎯 Exploit Status
Exploitation requires capturing valid signed requests through network interception, logs, or compromised systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.75.0
Vendor Advisory: https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f
Restart Required: Yes
Instructions:
1. Stop lakeFS service. 2. Update to version 1.75.0 or later. 3. Restart lakeFS service. 4. Rotate all S3 credentials used with lakeFS.
🔧 Temporary Workarounds
Credential Rotation
allFrequently rotate S3 credentials to limit window for replay attacks
Network Segmentation
allRestrict access to lakeFS S3 gateway to trusted networks only
🧯 If You Can't Patch
- Implement strict network monitoring for repeated identical requests
- Rotate all S3 credentials used with lakeFS immediately and establish frequent rotation schedule
🔍 How to Verify
Check if Vulnerable:
Check lakeFS version: if version < 1.75.0 and S3 gateway is enabled, system is vulnerable.Check Version:
lakefs versionVerify Fix Applied:
Verify lakeFS version is 1.75.0 or later and test that timestamp validation is enforced in S3 requests.📡 Detection & Monitoring
Log Indicators:
- Multiple identical S3 API requests with same signature from different sources/times
- Requests with expired timestamps being processed
Network Indicators:
- Repeated identical HTTP requests to lakeFS S3 endpoint
- Unusual request patterns matching previously observed traffic
SIEM Query:
source="lakefs" AND (message="S3 gateway request" OR message="signature") | stats count by src_ip, http_request, signature | where count > threshold