FreeBSD : minio -- Server Side Request Forgery (8ec7d426-055d-46bc-8f5a-a9d73a5a71ab)

high Nessus Plugin ID 145781

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Minio developers report :

Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.

All users are advised to upgrade ASAP.

The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).

In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 145781

File Name: freebsd_pkg_8ec7d426055d46bc8f5aa9d73a5a71ab.nasl

Version: 1.1

Type: local

Family: FreeBSD Local Security Checks

Published: 2/1/2021

Updated: 2/1/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:minio, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 1/31/2021

Vulnerability Publication Date: 1/29/2021

Detections

Analytics