CVE-2021-43858
📋 TL;DR
CVE-2021-43858 is a privilege escalation vulnerability in MinIO cloud storage software where a malicious client can craft HTTP API calls to update user policies and gain higher privileges. This affects all MinIO deployments prior to version RELEASE.2021-12-27T07-23-18Z. Attackers with existing user access can elevate their permissions to potentially administrative levels.
💻 Affected Systems
- MinIO
📦 What is this software?
Minio by Minio
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains full administrative control over the MinIO instance, allowing them to read, modify, or delete all stored data, create new users, and reconfigure the entire system.
Likely Case
An attacker with standard user access elevates privileges to perform unauthorized operations on buckets and objects they shouldn't have access to, potentially exfiltrating sensitive data.
If Mitigated
With proper network segmentation and least privilege access, impact is limited to the specific MinIO instance and its data, though privilege escalation within that system remains possible.
🎯 Exploit Status
Exploitation requires authenticated access but involves simple HTTP API manipulation. The vulnerability is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RELEASE.2021-12-27T07-23-18Z
Vendor Advisory: https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
Restart Required: Yes
Instructions:
1. Stop MinIO service. 2. Backup configuration and data. 3. Update to version RELEASE.2021-12-27T07-23-18Z or later. 4. Restart MinIO service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable password change API
allAdd explicit Deny rule to disable the vulnerable API endpoint for users
Add policy rule: {"Effect": "Deny", "Action": ["admin:SetPolicy"], "Resource": ["arn:aws:s3:::*"]}
🧯 If You Can't Patch
- Implement network segmentation to restrict access to MinIO API endpoints
- Apply strict IAM policies with least privilege and monitor for policy change attempts
🔍 How to Verify
Check if Vulnerable:
Check MinIO version with: minio version | grep -E 'RELEASE\.2021-12-27T07-23-18Z' - if not found and version is older, system is vulnerable.Check Version:
minio versionVerify Fix Applied:
Verify version is RELEASE.2021-12-27T07-23-18Z or newer: minio version📡 Detection & Monitoring
Log Indicators:
- Unusual admin:SetPolicy API calls
- Policy changes from non-admin users
- Multiple failed privilege escalation attempts
Network Indicators:
- HTTP POST requests to /minio/admin/v3/set-policy endpoint with crafted payloads
SIEM Query:
source="minio" AND (action="admin:SetPolicy" OR message="policy change" OR status="403" AND method="POST" AND path="/minio/admin/v3/set-policy")🔗 References
- https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf
- https://github.com/minio/minio/pull/13976
- https://github.com/minio/minio/pull/7949
- https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z
- https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
- https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf
- https://github.com/minio/minio/pull/13976
- https://github.com/minio/minio/pull/7949
- https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z
- https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
