CVE-2021-21362 : Vulnerability Insights and Analysis

A vulnerability in MinIO allows the bypassing of readOnly policy by creating a temporary 'mc share upload' URL, impacting users of MinIO multi-users. This vulnerability has a CVSS base score of 7.7, indicating a high severity issue.

Understanding CVE-2021-21362

This CVE describes the ability to bypass a readOnly policy in MinIO before version RELEASE.2021-03-04T00-53-13Z by using a temporary 'mc share upload' URL.

What is CVE-2021-21362?

MinIO, an open-source object storage service compatible with Amazon S3, is vulnerable to a readOnly policy bypass when utilizing a specific URL, affecting multi-user environments.

The Impact of CVE-2021-21362

The vulnerability allows unauthorized users to circumvent the readOnly policy, potentially compromising integrity but not confidentiality, with a CVSS base score of 7.7.

Technical Details of CVE-2021-21362

The vulnerability is classified under CWE-285 (Improper Authorization) and has a base score of 7.7 in CVSS v3.1.

Vulnerability Description

MinIO prior to RELEASE.2021-03-04T00-53-13Z is susceptible to a readOnly policy bypass when creating a temporary 'mc share upload' URL.

Affected Systems and Versions

Users of MinIO multi-users before version RELEASE.2021-03-04T00-53-13Z are impacted by this vulnerability.

Exploitation Mechanism

By generating a specific 'mc share upload' URL, attackers can bypass the readOnly policy in MinIO, potentially leading to unauthorized access.

Mitigation and Prevention

It is crucial to take immediate actions to address and prevent exploitation of this vulnerability in MinIO.

Immediate Steps to Take

Disable uploads with

Content-Type: multipart/form-data

in S3 API RESTObjectPOST docs or use a proxy in front of MinIO to mitigate the vulnerability.

Long-Term Security Practices

Regularly update MinIO to the patched version RELEASE.2021-03-04T00-53-13Z and follow secure coding practices to prevent similar authorization bypass issues.

Patching and Updates

Ensure that MinIO is updated to the fixed version RELEASE.2021-03-04T00-53-13Z to eliminate the readOnly policy bypass vulnerability.