CVE-2024-24747: MinIO Privilege Escalation Vulnerability

CVE-2024-24747 Overview

CVE-2024-24747 is a privilege escalation vulnerability [CWE-269] in MinIO, a high-performance object storage server compatible with Amazon S3. When a user creates an access key, the key inherits the parent's permissions for both s3:* and admin:* actions. Unless admin rights are explicitly denied higher in the access-key hierarchy, a child key can override its own s3 permissions and grant itself broader access than intended. This allows an authenticated user with a lower-privileged access key to escalate privileges and bypass configured object storage restrictions. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

Critical Impact
Authenticated users can override their own S3 permissions through inherited admin:* rights, enabling unauthorized read, write, and delete operations on object storage buckets.

Affected Products

MinIO server releases prior to RELEASE.2024-01-31T20-20-33Z
Deployments using access keys derived from parent service accounts
MinIO instances where admin:* actions are not explicitly denied in parent policies

Discovery Timeline

2024-01-31 - CVE-2024-24747 published to NVD
2024-01-31 - MinIO releases fixed version RELEASE.2024-01-31T20-20-33Z
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24747

Vulnerability Analysis

MinIO supports the creation of access keys tied to a parent identity, such as an IAM user or service account. The access key system was designed so child keys inherit a subset of the parent's permissions, typically scoped to S3 operations. The flaw exists in how MinIO evaluates administrative actions during key creation and policy assignment.

Because child keys inherit admin:* permissions alongside s3:* permissions, a user holding a lower-privileged child key can invoke administrative APIs to modify the policy attached to that key. The user can then grant themselves permissive S3 actions such as s3:GetObject, s3:PutObject, or s3:DeleteObject across buckets they were not originally authorized to access.

The issue affects any deployment where administrators assumed policy scoping alone would restrict child key capabilities. Because MinIO is frequently deployed as an S3-compatible backend for data lakes, backups, and container registries, exploitation can expose large volumes of sensitive data.

Root Cause

The root cause is improper privilege management [CWE-269] during access-key inheritance. MinIO propagates the full permission set of the parent identity, including administrative actions, unless those actions are explicitly denied by an upstream policy. The design fails to enforce least privilege by default for child keys.

Attack Vector

An attacker requires valid credentials for an access key whose parent identity holds administrative permissions. Using the MinIO admin API over the network, the attacker calls the policy-update endpoints to attach a broader policy to the current access key. Once the policy is updated, subsequent S3 requests succeed against buckets and objects that were previously out of reach. Refer to the GitHub Security Advisory GHSA-xx8w-mq23-29g4 for the vendor's technical description.

No public proof-of-concept code is required beyond standard MinIO client tooling such as mc admin commands issued with the compromised access key.

Detection Methods for CVE-2024-24747

Indicators of Compromise

Unexpected admin:* API calls originating from access keys not associated with administrators
Policy modification events on child access keys shortly after key creation
Sudden expansion of S3 operations (bucket listing, cross-bucket reads) from a previously scoped key
MinIO audit log entries showing SetPolicy, AddCannedPolicy, or UpdateServiceAccount from non-admin identities

Detection Strategies

Enable MinIO audit logging and forward events to a centralized SIEM for correlation
Alert on any admin:* action performed by an access key whose parent is a standard user
Baseline normal S3 access patterns per access key and detect deviations in bucket scope or operation type
Review IAM policy change history for child keys created before applying the patch

Monitoring Recommendations

Ingest MinIO audit and server logs into a centralized logging platform for retention and analysis
Monitor authentication and API activity across MinIO endpoints for policy escalation patterns
Track object storage read and write volumes per access key to identify anomalous data egress

How to Mitigate CVE-2024-24747

Immediate Actions Required

Upgrade all MinIO servers to RELEASE.2024-01-31T20-20-33Z or later without delay
Audit existing access keys and service accounts for unauthorized policy modifications
Rotate access keys created by non-administrative users prior to patching
Review and tighten parent policies to explicitly deny admin:* actions where not required

Patch Information

The fix is delivered in MinIO release RELEASE.2024-01-31T20-20-33Z. The corrective change is documented in the upstream commit 0ae4915a and the release notes. The patch prevents child access keys from inheriting admin:* permissions unless the parent policy explicitly grants them.

Workarounds

Attach an explicit deny policy for all admin:* actions to parent identities that do not require administrative capability
Restrict network exposure of the MinIO admin API to trusted management networks only
Disable the ability for non-admin users to create service accounts or access keys until patching is complete

bash

# Example: deny admin actions in a parent policy (policy.json)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["admin:*"],
      "Resource": ["arn:aws:s3:::*"]
    }
  ]
}

# Apply the policy with the MinIO client
mc admin policy create ALIAS deny-admin ./policy.json
mc admin policy attach ALIAS deny-admin --user USERNAME