GHSA-439h-2cx8-xwgx: 
Rust vulnerability analysis and mitigation

Audit finding SMB-1 (2026-11-09 audit, follow-up deep pass), severity high. Audited revision b7c8030f; line numbers refer to it. Static reading with upstream documentation; nothing was executed. Reproduce with a failing test before changing code.

Problem

In the vendored smb 0.10.2 client the status check runs inside upstream.recvo() and returns an error before _verify_incoming is called, and verify_plain_incoming accepts any message without the signed flag. An on-path party without credentials can therefore inject an unsigned STATUS_OBJECT_NAME_NOT_FOUND for a pending message id, even with require_encryption = true. smb.rs treats that as authoritative: blob_exists returns false, remove_file returns Ok, and collect_keys_once silently skips the directory. Worst case: graphql-orm-backup prune builds its reachable set from a listing; a truncated snapshot listing makes the client itself delete live backup objects. The same ordering is on upstream main, so updating does not fix it. Confirmed by reading; not reproduced on the wire.

Where

crates/graphql-orm-storage/vendor/smb/src/session/channel.rs:235-237, connection.rs:~806-818, connection/transformer.rs:343-350; crates/graphql-orm-storage/src/smb.rs:1102, :1183, :1793; crates/graphql-orm-backup/src/prune.rs:187-200

Suggested fix

Patch the vendored client to verify signature/encryption before evaluating status (only the MS-SMB2 3.2.5.1.3 exceptions). Make collect_keys_once fail closed on not-found for a directory it discovered by enumeration. Record the patch in PROVENANCE.json.

Acceptance

• A regression test fails before the change and passes after it.
• Docs and changelog state the corrected behaviour. Filed as a private draft advisory. Do not open issues or PRs on, or contact, any repository outside the Dastari and first-assist owners; upstream contact is the owner's decision.