CVE-2024-55949

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2024-12-13T22-19-12Z

Description The issue is related to a privilege escalation vulnerability in the IAM import API of MinIO, which is a high-performance, S3 compatible object store. This vulnerability allows any user to gain full admin privileges. The problem is caused by missing permissions checking in the API, allowing a user to change their policy mapping. All users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f.

Recommendations To resolve the issue, upgrade to RELEASE.2024-12-13T22-19-12Z or later. As a temporary workaround, consider blocking external access to the /minio/admin/v2/import-iam and /minio/admin/v3/import-iam-v2 API endpoints, for example, by using a load balancer or firewall such as nginx.