Inherited Permissions Vulnerability in MinIO Could Allow Overriding of Access Controls

CVE-2024-24747

What is CVE-2024-24747?

A vulnerability in MinIO High Performance Object Storage exists due to a design flaw in the access key creation process. When a new access key is generated, it inherits permissions from its parent key, including potentially unauthorized admin privileges. This design flaw could allow users to escalate their permissions beyond intended limits, especially if the parent access key is not configured to restrict admin rights. The issue poses a significant risk, as it can lead to unauthorized access and manipulation of critical data stored in object storage systems. A patch addressing this vulnerability has been released in version RELEASE.2024-01-31T20-20-33Z.

References