MinIO up to RELEASE.2021-12-27T07-23-18Z Access Key insecure preserved inherited permissions

Summaryinfo

A vulnerability described as critical has been identified in MinIO. This vulnerability affects unknown code of the component Access Key Handler. Such manipulation leads to insecure preserved inherited permissions. This vulnerability is referenced as CVE-2024-24747. It is possible to launch the attack remotely. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in MinIO. It has been rated as critical. Affected by this issue is an unknown code block of the component Access Key Handler. The manipulation with an unknown input leads to a insecure preserved inherited permissions vulnerability. Using CWE to declare the problem leads to CWE-278. A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement. Impacted is confidentiality, integrity, and availability. CVE summarizes:

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

The weakness was published 02/01/2024 as GHSA-xx8w-mq23-29g4. The advisory is available at github.com. This vulnerability is handled as CVE-2024-24747 since 01/29/2024. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version RELEASE.2024-01-31T20-20-33Z eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51976). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• MinIO

Version

• 0.12.3
• 2021-01-30T00-20-58Z
• 2021-03-17T02-33-02Z
• 2021-10-10T16-53-30Z
• 2021-10-13T00-23-17Z
• 2022-04-12T06-55-35Z
• 2023-03-20T20-16-18Z
• <=0.12.2
• <=2022-06-02T02-11-04Z
• RELEASE.2020-04-23T00-58-49Z
• RELEASE.2021-03-04T00-53-13Z
• RELEASE.2021-12-27T07-23-18Z

License

• open-source

Website

• Product: https://github.com/minio/minio/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion