ID:13137 - Exploit for Insecure Default Initialization of Resource in minio - CVE-2024-24747

Link to public exploit:

Vulnerability description

The vulnerability allows a low-privileged attacker to escalate privileges and access otherwise restricted buckets in a MinIO deployment.

The vulnerability exists due to MinIO access keys inheriting the parent key's administrative permissions, including admin:UpdateServiceAccount, unless explicitly denied in the access-key hierarchy. A low-privileged attacker can use a restricted access key with this inherited permission to replace its own policy with a more permissive policy and gain access to all buckets.

Remediation