CVE-2024-24747
HIGHMinIO < 0.0.0-20240131185645-0ae4915a9391 - Improper Privilege Management via Access Key Permission Inheritance
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-24747. PoCs published by Jenson Zhao, Immer5ion.
AI-analyzed exploit summary This exploit demonstrates a privilege escalation vulnerability in MinIO versions prior to RELEASE.2024-01-31T20-20-33Z. It creates a new service account with limited permissions, then escalates its privileges to gain access to additional buckets.
Description
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
Exploits (2)
This exploit demonstrates a privilege escalation vulnerability in MinIO versions prior to RELEASE.2024-01-31T20-20-33Z. It creates a new service account with limited permissions, then escalates its privileges to gain access to additional buckets.
The repository contains functional exploit code for CVE-2024-24747, a privilege escalation vulnerability in MinIO. The PoC demonstrates the vulnerability by creating new buckets and access keys, then verifying the exploit's success by comparing bucket lists before and after exploitation.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H