Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
Affects hubuum_clientSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.6.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| crates.iohubuum_client | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix has been proposed that routes all authentication, discovery, probe calls, export downloads, unified-search streams, raw and typed requests through the configured custom transport in both async and blocking clients. It also disables redirect following in built-in clients to maintain endpoint validation. Users should upgrade to version 0.6.1 or later once available to apply this fix. Until then, avoid using custom transports or carefully review network traffic to detect bypasses.
Description
The hubuum_client Rust library versions 0.3.0 up to but not including 0.6.1 has a vulnerability where configured custom transports can be bypassed. Several client operations, including password login and token validation, use the built-in reqwest client directly instead of the custom transport, potentially exposing credentials and network traffic outside intended security controls. This bypass affects network isolation, proxy enforcement, request signing, audit logging, and policy checks. A fix has been proposed to route all relevant calls through the configured transport and disable redirect following in built-in clients to maintain endpoint validation.
Impact
Applications using custom transports for security purposes (network isolation, proxy enforcement, request signing, audit logging, or policy enforcement) may have these controls bypassed for several client operations. This can lead to exposure of plaintext passwords and bearer tokens outside the intended secure transport, and allow network requests to evade audit and routing policies. The vulnerability affects versions >=0.3.0 <0.6.1 of hubuum_client. Applications not using custom transports are not impacted.
Summary
hubuum_client versions >=0.3.0 <0.6.1 allow bypass of configured custom transports for certain client operations such as password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams. This results in direct network requests using the built-in reqwest client, circumventing security boundaries established by custom transports. The vulnerability can expose plaintext credentials and bearer tokens outside the intended transport, and evade audit and routing policies. The issue does not affect applications that do not configure a custom transport. The proposed fix ensures all client calls route through the configured transport and disables redirect following in built-in clients to preserve security controls.
Weaknesses
References
- github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-qqc3-94qv-7fw3 (opens in a new tab)
- github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50 (opens in a new tab)
- github.com/hubuum/hubuum-client-rust (opens in a new tab)
- github.com/hubuum/hubuum-client-rust/releases/tag/v0.6.1 (opens in a new tab)