PT-2021-23119 · Minio · Minio

Harshavardhana · Published 2021-10-13 · Updated 2024-03-06 · CVE-2021-41137

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Minio versions RELEASE.2021-10-10T16-53-30Z through RELEASE.2021-10-12T23-59-59Z

Description The issue involves bypassing policy restrictions on regular users in Minio, a Kubernetes native application for cloud storage. Normally, the checkKeyValid() function should return owner true for rootCreds. However, in the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts.

Recommendations For versions RELEASE.2021-10-10T16-53-30Z through RELEASE.2021-10-12T23-59-59Z, update to RELEASE.2021-10-13T00-23-17Z to resolve the issue. As a temporary workaround, consider downgrading back to release RELEASE.2021-10-08T23-58-24Z.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-MINIO-2021-41137

CVE-2021-41137

GHSA-V64V-G97P-577C

Affected Products

Minio

References · 8

• https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbd · Patch
• https://github.com/minio/minio/pull/13422 · Patch
• https://github.com/minio/minio/pull/13388 · Patch
• https://osv.dev/vulnerability/BIT-minio-2021-41137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41137 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41137 · Vendor Advisory
• https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c · Note
• https://t.me/cibsecurity/30508 · Telegram Post