Bypassing readOnly policy by creating a temporary 'mc share upload' URL
CVE-2021-21362

7.7HIGH

Key Information:

Vendor

Minio

Status
Minio
Vendor
CVE Published:
8 March 2021

What is CVE-2021-21362?

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with Content-Type: multipart/form-data as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.

Affected Version(s)

minio < RELEASE.2021-03-04T00-53-13Z

References

https://github.com/minio/minio/security/advisories/GHSA-h...
x_refsource_CONFIRM
https://github.com/minio/minio/pull/11682
x_refsource_MISC
https://github.com/minio/minio/commit/039f59b552319fcc2f8...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.