CVE-2021-21362
📋 TL;DR
MinIO versions before RELEASE.2021-03-04T00-53-13Z contain a policy bypass vulnerability where users with read-only permissions can create temporary upload URLs to bypass access controls. This affects all MinIO deployments with multiple users configured. Attackers can upload unauthorized content despite read-only policy restrictions.
💻 Affected Systems
- MinIO
📦 What is this software?
Minio by Minio
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users upload malicious files, execute arbitrary code, or exfiltrate sensitive data by bypassing all access controls.
Likely Case
Users with read-only permissions upload unauthorized content, potentially compromising data integrity or introducing malware.
If Mitigated
Minimal impact with proper network segmentation, monitoring, and the workaround implemented.
🎯 Exploit Status
Exploit requires valid user credentials but minimal technical skill; detailed in GitHub advisory and commit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RELEASE.2021-03-04T00-53-13Z
Vendor Advisory: https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v
Restart Required: Yes
Instructions:
1. Stop MinIO service. 2. Backup configuration and data. 3. Update to RELEASE.2021-03-04T00-53-13Z or later. 4. Restart MinIO service. 5. Verify version and functionality.
🔧 Temporary Workarounds
Disable multipart/form-data uploads via proxy
allBlock uploads with Content-Type: multipart/form-data using a reverse proxy in front of MinIO
# Configure proxy (e.g., nginx) to block: location / { if ($content_type ~* multipart/form-data) { return 403; } }
🧯 If You Can't Patch
- Implement the proxy workaround to block multipart/form-data uploads
- Restrict network access to MinIO, implement strict IAM policies, and enable detailed audit logging
🔍 How to Verify
Check if Vulnerable:
Check MinIO version; if before RELEASE.2021-03-04T00-53-13Z and multi-user configured, it's vulnerable.Check Version:
minio versionVerify Fix Applied:
Confirm version is RELEASE.2021-03-04T00-53-13Z or later and test that read-only users cannot create upload URLs.📡 Detection & Monitoring
Log Indicators:
- Unexpected uploads from read-only users
- mc share upload API calls from unauthorized accounts
Network Indicators:
- POST requests with multipart/form-data to MinIO from unexpected sources
SIEM Query:
source="minio" AND (event="upload" OR api="share") AND user_role="read-only"🔗 References
- https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482
- https://github.com/minio/minio/pull/11682
- https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z
- https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v
- https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482
- https://github.com/minio/minio/pull/11682
- https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z
- https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v
