## Summary
SeaweedFS versions prior to 4.24 expose the SeaweedIdentityAccessManagement (IAM) gRPC service on the filer without mandatory authentication when jwt.filer_signing.key is unset. Any network client that can reach the filer gRPC port could invoke IAM RPCs to mint credentials and obtain S3 administrative control.
## Technical Details
- The filer registers the IAM gRPC service without enforcing authentication when jwt.filer_signing.key is empty.
- An unauthenticated caller could invoke IAM RPCs such as:
- CreateUser
- CreateAccessKey
- PutUserPolicy (and related IAM calls)
- The impact is credential minting and self-granting S3 admin privileges, resulting in full compromise of stored object confidentiality, integrity, and availability.
- Even enabling documented JWT signing keys does not close the issue because the IAM gRPC service was not gated by that mechanism.
- Fix behavior in 4.24:
- The service refuses to register unless jwt.filer_signing.key is configured.
- Every IAM RPC now requires an Authorization: Bearer <JWT> token signed with the filer admin signing key.
- Code-level change (from the referenced commit): startFiler() now conditionally registers the IAM service only when jwt.filer_signing.key is non-empty.
## Affected
- SeaweedFS filer IAM gRPC service: weed/server/filer_server_handlers_iam_grpc.go, weed/command/filer.go
- Affected versions: prior to 4.24
## Impact
- Unauthenticated remote attackers (network-reachable gRPC port) can mint credentials and grant S3 administrative privileges, leading to full compromise of confidentiality, integrity, and availability of stored objects.
## Mitigation
1. Upgrade SeaweedFS to 4.24 or later (fix removes the unauthenticated default and enforces Bearer-JWT admin auth for IAM RPCs).
2. If you must operate temporarily, restrict network access to the filer gRPC port to trusted hosts only.
3. Configure jwt.filer_signing.key in security.toml and ensure all IAM RPC clients attach an admin-signed Bearer token on every call.
4. Validate operational behavior: after upgrade, confirm the IAM service registers only when jwt.filer_signing.key is set and that IAM calls include the required token.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306