CVE-2022-24842: Improper Privilege Management in MinIO
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in RELEASE.2022-04-12T06-55-35Z. Users unable to upgrade may workaround this issue by explicitly adding a admin:CreateServiceAccount deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24842?
CVE-2022-24842 has been rated as a high severity vulnerability due to the potential for non-admin users to escalate privileges.
How do I fix CVE-2022-24842?
To fix CVE-2022-24842, upgrade MinIO to a version released after April 12, 2022, which addresses this security issue.
Who is affected by CVE-2022-24842?
CVE-2022-24842 affects MinIO versions between December 9, 2021, and April 12, 2022, particularly installations allowing non-admin user actions.
What type of vulnerability is CVE-2022-24842?
CVE-2022-24842 is a privilege escalation vulnerability that allows non-admin users to create service accounts for higher-privileged users.
Can CVE-2022-24842 be exploited remotely?
Yes, CVE-2022-24842 can be exploited remotely if the attacker has access to the MinIO service.