Improper Privilege Management in minio.io minio

1) Improper Privilege Management

EUVDB-ID: #VU64785

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-24842

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper privilege management. A remote non-admin user can create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

minio: 2021-12-09T06-19-41Z - 2022-04-09T15-09-52Z

CPE2.3

• cpe:2.3:a:minio.io:minio:2021-12-09T06-19-41Z:*:*:*:*:*:*:*
• cpe:2.3:a:minio.io:minio:2021-12-10T23-03-39Z:*:*:*:*:*:*:*
• cpe:2.3:a:minio.io:minio:2021-12-18T04-42-33Z:*:*:*:*:*:*:*

External links

https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q
https://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3
https://github.com/minio/minio/pull/14729

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.