PT-2021-3472 · Minio+1 · Minio+1

Harshavardhana + 1 · CVE-2021-21362 · Published 2021-03-04 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2021-03-04T00-53-13Z

Description The issue is related to authorization errors in MinIO, an open-source high performance object storage service compatible with Amazon S3 cloud storage. It allows a remote attacker to bypass a readOnly policy by creating a temporary 'mc share upload' URL, potentially impacting the integrity of protected information. Everyone using MinIO multi-users is impacted.

Recommendations For versions prior to RELEASE.2021-03-04T00-53-13Z, update to version RELEASE.2021-03-04T00-53-13Z to resolve the issue. As a temporary workaround, consider disabling uploads with Content-Type: multipart/form-data by using a proxy in front of MinIO, as mentioned in the S3 API RESTObjectPOST docs.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

ALT-PU-2021-1565

ALT-PU-2022-1258

BDU:2021-03386

BIT-MINIO-2021-21362

CVE-2021-21362

GHSA-HQ5J-6R98-9M8V

Affected Products

Alt Linux

Minio

References · 11

• 🔥 https://github.com/minio/minio/pull/11682 · Exploit
• https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482 · Patch
• https://osv.dev/vulnerability/CVE-2021-21362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21362 · Security Note
• https://bdu.fstec.ru/vul/2021-03386 · Security Note
• https://osv.dev/vulnerability/BIT-minio-2021-21362 · Vendor Advisory
• https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v · Note
• https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z · Note
• https://ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-redis-minio-golang-and-urllib3-affect-ibm-spectrum-protect-plus-container-backup-and-restore-for-kubernetes-and-openshift · Note
• https://t.me/cibsecurity/24575 · Telegram Post
• https://t.me/cvenotify/10996 · Telegram Post