Harshavardhana

An authentication bypass exists in the `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path. An attacker possessing a valid access key can write arbitrary objects to any bucket without a secret key or a valid cryptographic signature. The issue occurs because `PutObjectHandler` and `PutObjectPartHandler` utilize `newUnsignedV4ChunkedReader` with a signature verification gate that relies only on the `Authorization` header. Simultaneously, `isPutActionAllowed` accepts credentials from either the `Authorization` header or the `X-Amz-Credential` query parameter. By omitting the `Authorization` header and providing credentials via the query string, the signature gate is bypassed, and the request is processed using the permissions of the impersonated access key. This affects standard and tables/warehouse bucket paths as well as multipart uploads.

A flaw in the `extractMetadataFromMime()` function allows any authenticated user with `s3:PutObject` permission to inject internal server-side encryption metadata into objects. This is achieved by sending crafted `X-Minio-Replication-*` headers on a normal PutObject request. The server incorrectly maps these headers to internal encryption metadata without verifying the request's legitimacy. Objects written in this manner become permanently unreadable through the S3 API. The issue was introduced in commit `468a9fae83e965ecefa1c1fdc2fc57b84ece95b0` on 2024-03-28. The affected component is `cmd/handler-utils.go`.

The MinIO AIStor Security Token Service (STS) `AssumeRoleWithLDAPIdentity` endpoint is susceptible to LDAP credential brute-forcing. This is due to a combination of distinguishable error responses that allow for username enumeration and the absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then attempt unlimited password guesses to obtain temporary AWS-style STS credentials, potentially gaining access to the victim's S3 buckets and objects. The issue involves two weaknesses: user enumeration via distinguishable error messages and missing rate limiting on STS authentication endpoints. Exploitation allows an attacker to enumerate valid LDAP usernames, perform high-speed password brute-force attacks, and, upon success, obtain temporary AWS-style STS credentials with full access to the victim user's S3 resources. The API endpoint `/Action=AssumeRoleWithLDAPIdentity` is involved in this issue.

The issue is related to a user with `consoleAdmin` permissions potentially creating a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. Exploitation of this issue may allow a remote attacker to disable access to the root credentials.

The issue is related to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected.

The issue involves bypassing policy restrictions on regular users in Minio, a Kubernetes native application for cloud storage. Normally, the `checkKeyValid()` function should return owner true for `rootCreds`. However, in the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts.

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. The issue enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using `aws-chunked` encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature.

The issue is related to authorization errors in MinIO, an open-source high performance object storage service compatible with Amazon S3 cloud storage. It allows a remote attacker to bypass a readOnly policy by creating a temporary 'mc share upload' URL, potentially impacting the integrity of protected information. Everyone using MinIO multi-users is impacted.

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2021-01-30T00-20-58Z Description: The issue is related to a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. An attacker can modify the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built, allowing them to abuse functionality on the server to read or update internal resources. This can enable the attacker to read server configuration, connect to internal services, or perform post requests towards internal services that are not intended to be exposed. Recommendations: For versions prior to RELEASE.2021-01-30T00-20-58Z, upgrade to version RELEASE.2021-01-30T00-20-58Z or later. As a temporary workaround, consider disabling the browser front-end by setting the `MINIO BROWSER` environment variable to `off`.

The issue allows for an authentication bypass in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations, such as creating new service accounts for existing access keys, without knowing the admin secret key.