CVE-2024-55949 Privilege escalation in IAM import API in MinIO
Attackers can escalate privileges via the IAM import API in MinIO, requiring an immediate upgrade to the latest release.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-55949?
CVE-2024-55949 is a critical vulnerability in minio, published on 16 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.
Weakness: CWE-269
Which versions are affected by CVE-2024-55949?
3 open source packages ship an affected version, including github.com/minio/minio.
| Package | Affected | Fixed in |
|---|---|---|
github.com/minio/minio Go | From 0.0.0-20220623162515-580d9db85e04 | 0.0.0-20241213221912-68b004a48f41 |
github.com/minio/minio Go | From 0.0.0-20220623162515-580d9db85e04 | 0.0.0-20241213221912-68b004a48f41 |
github.com/minio/minio Go | From 0.0.0-20220623162515-580d9db85e04 | 0.0.0-20241213221912-68b004a48f41 |
How do I fix CVE-2024-55949?
Upgrade github.com/minio/minio to 0.0.0-20241213221912-68b004a48f41 or later.
Is CVE-2024-55949 being exploited?
There is no known exploitation of CVE-2024-55949 in the wild and no public exploit code.
Sources
Also known as GHSA-cwq8-g58r-32hg, GO-2024-3336.