MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-27 12:53:45 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix user privilege escalation bug (#13976)

Browse Source 
The AddUser() API endpoint was accepting a policy field. 
This API is used to update a user's secret key and account 
status, and allows a regular user to update their own secret key. 

The policy update is also applied though does not appear to 
be used by any existing client-side functionality.

This fix changes the accepted request body type and removes 
the ability to apply policy changes as that is possible via the 
policy set API.

NOTE: Changing passwords can be disabled as a workaround
for this issue by adding an explicit "Deny" rule to disable the API
for users.
This commit is contained in:
Aditya Manthramurthy
2021-12-23 09:21:21 -08:00
committed by GitHub
parent 416977436e
commit 5a96cbbeaa
7 changed files with 143 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@@ -49,7 +49,7 @@ require (
github.com/minio/csvparser v1.0.0
github.com/minio/highwayhash v1.0.2
github.com/minio/kes v0.14.0
github.com/minio/madmin-go v1.1.18
github.com/minio/madmin-go v1.1.20
github.com/minio/minio-go/v7 v7.0.17
github.com/minio/parquet-go v1.1.0
github.com/minio/pkg v1.1.9