CVE-2021-21390: 
MinIO vulnerability analysis and mitigation

MinIO, an open-source high-performance object storage service that is API compatible with Amazon S3 cloud storage service, was found to contain a vulnerability (CVE-2021-21390) in versions before RELEASE.2021-03-17T02-33-02Z. The vulnerability enables man-in-the-middle (MITM) modification of request bodies that are meant to have integrity guaranteed by chunk signatures (GitHub Advisory, NVD).

The vulnerability occurs in PUT requests using aws-chunked encoding. Normally, MinIO verifies signatures at the end of a chunk. However, this security check can be bypassed if the client sends a false chunk size that is much greater than the actual data sent. In such cases, the server accepts and completes the request without reaching the end of the chunk, thereby skipping the chunk signature verification (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) by NIST and 6.5 (Medium) by GitHub (NVD).

This security issue enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. The vulnerability compromises the integrity protection mechanism of the chunked upload feature, potentially allowing attackers to modify data during transmission without detection (GitHub Advisory).

The vulnerability can be exploited by manipulating the chunk size in PUT requests using aws-chunked encoding. An attacker can bypass signature verification by specifying a chunk size larger than the actual data being sent (GitHub Advisory).

The vulnerability was patched in version RELEASE.2021-03-17T02-33-02Z. As a workaround, users can avoid using 'aws-chunked' encoding-based chunk signature upload requests and instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS (GitHub Advisory).