CVE-2024-24747: MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
Vulnerability summary
CVE-2024-24747 is a high (CVSS 8.8) Improper Privilege Management vulnerability in minio. EPSS estimates a 34.09% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 31-01-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
34.09%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 34.09% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundMinio
Maturity: poc
MinIO < 2024-01-31T20-20-33Z - Privilege Escalation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Github.com/minio1 product
- minio< 0.0.0-20240131185645-0ae4915a9391
Minio1 product
- minio< RELEASE.2024-01-31T20-20-33Z | 2024-01-31t20-20-33z
2 vendors · 2 products
References
5 links- github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4X Refsource CONFIRMWEBAdvisoryExploitPatchVendor Advisory
- github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33ZX Refsource MISCWEBPatchRelease Notes
- github.com/minio/minioPACKAGE