{"id":"CVE-2024-24747","published":"2024-01-31T22:10:23Z","modified":"2024-08-01T23:28:11Z","title":"MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","vendor":"minio","product":"minio","tier":"tail","description":{"text":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.34086,"percentile":0.98397,"provenance":"source"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","tags":["x_refsource_MISC"]},{"url":"https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z","tags":["x_refsource_MISC"]}],"priority":{"score":30.8,"factors":[{"name":"EPSS percentile","points":19.68},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.16}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2024-04-12"},"first":{"date":"2024-04-12","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/51976"},"provenance":"source"},"vendorSlug":"minio","affectedVersions":[{"vendor":"minio","product":"minio","versions":["< RELEASE.2024-01-31T20-20-33Z"]}],"affected":[{"ecosystem":"Go","package":"github.com/minio/minio","vulnerableRanges":["<0.0.0-20240131185645-0ae4915a9391"],"patched":["0.0.0-20240131185645-0ae4915a9391"],"from":["GHSA-xx8w-mq23-29g4","GO-2024-2499"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0775","exploited":false,"provenance":"source"},"exploits":[{"id":51976,"url":"https://www.exploit-db.com/exploits/51976","title":"MinIO < 2024-01-31T20-20-33Z - Privilege Escalation","date":"2024-04-12","verified":false,"provenance":"source"}],"lineage":{"familyId":"fam-minio-cve-2023-28434","parents":[{"from":"CVE-2023-28434","to":"CVE-2024-24747","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/auth-handler.go"],"commits":["https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5","https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2024-24747","to":"CVE-2024-55949","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/admin-handlers-users.go"],"commits":["https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427","https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f"],"basis":"rarely changed file"}]},{"from":"CVE-2024-24747","to":"CVE-2025-31489","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/auth-handler.go"],"commits":["https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-28434","published":"2023-03-22","fixed":"0.0.0-202303200415","kev":true},{"cve":"CVE-2023-28433","published":"2023-03-22","fixed":"0.0.0-202303200735","kev":false,"link":{"from":"CVE-2023-28433","to":"CVE-2024-24747","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-202303200735","toFixed":"0.0.0-20240131185645-0ae4915a9391","daysApart":315}]}},{"cve":"CVE-2024-24747","published":"2024-01-31","fixed":"0.0.0-20240131185645-0ae4915a9391","kev":false},{"cve":"CVE-2024-36107","published":"2024-05-28","fixed":"0.0.0-20240527191746-e0fe7cc39172","kev":false,"link":{"from":"CVE-2024-24747","to":"CVE-2024-36107","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20240131185645-0ae4915a9391","toFixed":"0.0.0-20240527191746-e0fe7cc39172","daysApart":118}]}},{"cve":"CVE-2024-55949","published":"2024-12-16","fixed":"0.0.0-20241213221912-68b004a48f41","kev":false},{"cve":"CVE-2025-27414","published":"2025-02-28","fixed":"0.0.0-20250227184332-4c71f1b4ec0f","kev":false}],"package":"Go:github.com/minio/minio"}}