CVE-2021-21362

Name
CVE-2021-21362
Description
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482
Exploit https://github.com/minio/minio/pull/11682
Third Party Advisory https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v
Release Notes https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:* minio >= None < 2021-03-04t00-53-13z

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
minio 3.17-community 0.20221029.062133-r5 Drew DeVault <sir@cmpwn.com> possibly vulnerable
minio 3.18-community 0.20230920.224955-r2 Celeste <cielesti@protonmail.com> possibly vulnerable
minio 3.19-community 0.20240131.202033-r3 Celeste <cielesti@protonmail.com> possibly vulnerable
minio 3.20-community 0.20240527.191746-r2 Celeste <cielesti@protonmail.com> possibly vulnerable
minio edge-community 0.20241107.005220-r0 Celeste <cielesti@protonmail.com> possibly vulnerable