Description
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| minio | minio | < RELEASE.2024-01-31T20-20-33Z | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | minio | 0.20240131.202033-r0 | — |
| Alpine v3.23 | minio | 0.20240131.202033-r0 | — |
| Alpine v3.22 | minio | 0.20240131.202033-r0 | — |
| Alpine v3.21 | minio | 0.20240131.202033-r0 | — |
| Alpine v3.20 | minio | 0.20240131.202033-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | minio | 0.20240131.202033-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MinIO < 2024-01-31T20-20-33Z - Privilege Escalation EDB-51976 · remote · Apr 12, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/minio/minio | < 0.0.0-20240131185645-0ae4915a9391 | 0.0.0-20240131185645-0ae4915a9391 | GHSA-xx8w-mq23-29g4 |