Path Traversal Affecting github.com/minio/minio/cmd package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMMINIOMINIOCMD-2964945
- published 2 Aug 2022
- disclosed 2 Aug 2022
- credit Lenin Alevski
Introduced: 2 Aug 2022
CVE-2022-35919 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs.
Affected versions of this package are vulnerable to Path Traversal which allows users authorized for admin:ServerUpdate to selectively trigger an error that in response, returns the content of the path requested.
Note: The issue was resolved since version RELEASE.2022-07-29T19-40-48Z
PoC:
mc admin update alias/ /etc/passwd
The error response will contain the contents of the /etc/passwd file.
Mitigation:
Disabling the ServerUpdate API by denying the admin:ServerUpdate action for your admin users via IAM policies.