PT-2022-16916 · Minio+1 · Minio+1

Gbd199 · Published 2022-04-12 · Updated 2024-12-26 · CVE-2022-24842

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2022-04-12T06-55-35Z

Description A security issue was found in MinIO where a non-admin user can create service accounts for root or other admin users and then assume their access policies via the generated credentials, allowing the user to escalate privilege to that of the root user.

Recommendations For versions prior to RELEASE.2022-04-12T06-55-35Z, update to RELEASE.2022-04-12T06-55-35Z or later to resolve the issue. As a temporary workaround, consider explicitly adding an admin:CreateServiceAccount deny policy, however, this will deny the user the ability to create their own service accounts as well.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

ALT-PU-2022-3382

ALT-PU-2023-1522

ALT-PU-2023-1908

ALT-PU-2023-2074

ALT-PU-2024-17529

BIT-MINIO-2022-24842

CVE-2022-24842

GHSA-2J69-JJMG-534Q

Affected Products

Alt Linux

Minio

References · 17

• 🔥 https://github.com/minio/minio/pull/14729 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24842.json · Exploit
• 🔥 https://github.com/MzzdToT/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2023-28432 · Exploit
• 🔥 https://github.com/acheiii/CVE-2023-28432 · Exploit
• 🔥 https://github.com/0rx1/cve-2021-43858 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-28432 · Exploit
• 🔥 https://github.com/yTxZx/CVE-2023-28432 · Exploit
• https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q · Patch
• https://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3 · Patch
• https://osv.dev/vulnerability/BIT-minio-2022-24842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24842 · Security Note