Improper Privilege Management in minio.io minio

1) Improper Privilege Management

EUVDB-ID: #VU64694

Risk: High

CVSSv4.0: 7.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-43858

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: Yes

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper privilege management in AddUser() function admin API. A remote user can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

minio: 2021-01-05T05-22-38Z - 2021-12-20T22-07-16Z

CPE2.3

• cpe:2.3:a:minio.io:minio:2021-01-05T05-22-38Z:*:*:*:*:*:*:*
• cpe:2.3:a:minio.io:minio:2021-01-08T21-18-21Z:*:*:*:*:*:*:*
• cpe:2.3:a:minio.io:minio:2021-01-16T02-19-44Z:*:*:*:*:*:*:*

External links

https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf
https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z
https://github.com/minio/minio/pull/13976
https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
https://github.com/minio/minio/pull/7949
https://bugzilla.redhat.com/show_bug.cgi?id=2036252

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.