Donatello

**Name of the Vulnerable Software and Affected Versions** MinIO versions prior to RELEASE.2024-12-13T22-19-12Z **Description** The issue is related to a privilege escalation vulnerability in the IAM import API of MinIO, which is a high-performance, S3 compatible object store. This vulnerability allows any user to gain full admin privileges. The problem is caused by missing permissions checking in the API, allowing a user to change their policy mapping. All users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. **Recommendations** To resolve the issue, upgrade to RELEASE.2024-12-13T22-19-12Z or later. As a temporary workaround, consider blocking external access to the `/minio/admin/v2/import-iam` and `/minio/admin/v3/import-iam-v2` API endpoints, for example, by using a load balancer or firewall such as `nginx`.

**Name of the Vulnerable Software and Affected Versions** MinIO versions prior to RELEASE.2023-03-20T20-16-18Z **Description** MinIO, a Multi-Cloud Object Storage framework, contains a security flaw within the `PostPolicyBucket` component related to privilege management errors. An attacker with `arn:aws:s3:::*` permissions and enabled Console API access can exploit this issue by sending specially crafted HTTP requests to bypass metadata bucket name checking and place objects into any bucket. This could potentially lead to privilege escalation. There is no information available regarding the number of affected devices or real-world exploitation of this issue. The vulnerable code resides in `minio/cmd/generic-handlers.go` within the `setRequestValidityHandler` function. The `PostPolicyBucket` component is susceptible to bypass due to improper handling of bucket name validation. **Recommendations** Upgrade to RELEASE.2023-03-20T20-16-18Z or later. As a temporary workaround, enable browser API access and turn off `MINIO BROWSER=off`.

**Name of the Vulnerable Software and Affected Versions** Minio versions prior to RELEASE.2023-03-20T20-16-18Z **Description** The issue is related to insufficient access control in Minio, a Multi-Cloud Object Storage framework. Minio fails to filter the `` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. **Recommendations** For versions prior to RELEASE.2023-03-20T20-16-18Z, update to RELEASE.2023-03-20T20-16-18Z or later to resolve the issue. At the moment, there are no known workarounds for this issue.

**Name of the Vulnerable Software and Affected Versions** MinIO versions prior to RELEASE.2021-12-27T07-23-18Z **Description** The issue is related to insecure privilege management in MinIO, a Kubernetes native application for cloud storage. It allows a remote attacker to elevate their privileges by crafting an HTTP API call. The vulnerability can be exploited to update a user's policy and gain higher privileges. **Recommendations** For versions prior to RELEASE.2021-12-27T07-23-18Z, update to version RELEASE.2021-12-27T07-23-18Z or later, which changes the accepted request body type and removes the ability to apply policy changes through this API. As a temporary workaround, consider adding an explicit `Deny` rule to disable the API for users, which can prevent password changes.