PT-2021-23227 · Minio · Minio

Alevsk + 1 · Published 2021-11-15 · Updated 2024-08-21 · CVE-2021-41266

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Minio console versions prior to 0.12.3

Description The Minio console is subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. This issue affects all users on release v0.12.2 and before. The estimated number of potentially affected devices worldwide is not available. There have been no reported real-world incidents where this issue was exploited. Technical details about exploitation include the use of external IDP authentication. To exploit this issue, an attacker would need to target the Operator Console with an external IDP enabled.

Recommendations For versions prior to 0.12.3, update to 0.12.3 or newer. For users unable to upgrade, add automountServiceAccountToken: false to the operator-console deployment in Kubernetes and disable the external identity provider authentication by unsetting the CONSOLE IDP URL, CONSOLE IDP CLIENT ID, CONSOLE IDP SECRET, and CONSOLE IDP CALLBACK environment variables, then use the Kubernetes service account token instead.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-41266

GHSA-4999-659W-MQ36

GO-2022-0261

Affected Products

Minio

References · 9

• 🔥 https://github.com/minio/console/pull/1217 · Exploit
• https://osv.dev/vulnerability/CVE-2021-41266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41266 · Security Note
• https://osv.dev/vulnerability/GHSA-4999-659w-mq36 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0261 · Vendor Advisory
• https://github.com/minio/console/security/advisories/GHSA-4999-659w-mq36 · Note
• https://github.com/minio/console · Note
• https://t.me/cvenotify/23487 · Telegram Post
• https://t.me/cibsecurity/32511 · Telegram Post