MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-22 18:47:43 -05:00
Code Issues Packages Projects Releases Wiki Activity

Valid if bucket names are internal (#7476)

Browse Source 
This commit fixes a privilege escalation issue against
the S3 and web handlers. An authenticated IAM user
can:

- Read from or write to the internal '.minio.sys'
bucket by simply sending a properly signed
S3 GET or PUT request. Further, the user can
- Read from or write to the internal '.minio.sys'
bucket using the 'Upload'/'Download'/'DownloadZIP'
API by sending a "browser" request authenticated
with its JWT token.
This commit is contained in:
Harshavardhana
2019-04-03 23:10:37 -07:00
committed by kannappanr
parent 9a740736a4
commit c90999df98
8 changed files with 92 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/web-handlers_test.go
View File

@@ -334,13 +334,13 @@ func testDeleteBucketWebHandler(obj ObjectLayer, instanceType string, t TestErrH
// Empty string = no error
expect string
}{
{"", false, token, "The specified bucket does not exist."},
{"", false, token, "The specified bucket is not valid"},
{".", false, "auth", "Authentication failed"},
{".", false, token, "The specified bucket . does not exist."},
{"..", false, token, "The specified bucket .. does not exist."},
{"ab", false, token, "The specified bucket ab does not exist."},
{".", false, token, "The specified bucket is not valid"},
{"..", false, token, "The specified bucket is not valid"},
{"ab", false, token, "The specified bucket is not valid"},
{"minio", false, "false token", "Authentication failed"},
{"minio", false, token, "specified bucket minio does not exist"},
{"minio", false, token, "The specified bucket is not valid"},
{bucketName, false, token, ""},
{bucketName, true, token, "Bucket not empty"},
{bucketName, false, "", "JWT token missing"},