PT-2021-7169 · Minio+1 · Minio+1
Donatello
·
Published
2021-12-27
·
Updated
2024-12-26
·
CVE-2021-43858
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
MinIO versions prior to RELEASE.2021-12-27T07-23-18Z
Description
The issue is related to insecure privilege management in MinIO, a Kubernetes native application for cloud storage. It allows a remote attacker to elevate their privileges by crafting an HTTP API call. The vulnerability can be exploited to update a user's policy and gain higher privileges.
Recommendations
For versions prior to RELEASE.2021-12-27T07-23-18Z, update to version RELEASE.2021-12-27T07-23-18Z or later, which changes the accepted request body type and removes the ability to apply policy changes through this API.
As a temporary workaround, consider adding an explicit
Deny rule to disable the API for users, which can prevent password changes.Exploit
Fix
Incorrect Authorization
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Minio