Executive brief
rust-iot-platform is a Rust-based IoT development platform that handles user authentication and account management. This vulnerability stores user passwords in plaintext without hashing, allowing anyone with access to API responses (user retrieval and listing endpoints) to obtain valid login credentials for all accounts, leading to unauthorized access to accounts and the IoT platform.
Technical details
The vulnerability is a failure to implement password hashing: user passwords are stored in cleartext in the user model within the API layer (user_biz.rs). The API endpoints for user retrieval and listing return unencrypted password fields in their JSON responses. An attacker with network access to these endpoints (which may be publicly reachable or accessible after authentication bypass) can immediately obtain plaintext credentials for all accounts. There is no indication of rate limiting, access controls, or encryption on these sensitive endpoints. A patch requires implementing cryptographic hashing (bcrypt, scrypt, argon2) and removing plaintext passwords from API responses.
Affected products
- iot-ecology rust-iot-platform through commit 5df942ab
Timeline
- 2026-08-29: disclosed