GO-2022-0261: Authentication bypass issue in the Operator Console in github.com/minio/console

acl

package

v0.12.0 Latest Latest Go to latest Published: Nov 3, 2021 License: AGPL-3.0 Imports: 3 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/minio/console

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func GetActionsStringFromPolicy(policy *iampolicy.Policy) []string
func GetAuthorizedEndpoints(actions []string) []string
func GetLDAPEnabled() bool
func GetOperatorMode() bool
type ConfigurationActionSet

Constants ¶

View Source

const (

	// const for ldap configuration
	ConsoleLDAPEnabled = "CONSOLE_LDAP_ENABLED"
)

Variables ¶

View Source

var BucketAdminRole = iampolicy.NewActionSet(
	iampolicy.AbortMultipartUploadAction,
	iampolicy.CreateBucketAction,
	iampolicy.DeleteBucketAction,
	iampolicy.ForceDeleteBucketAction,
	iampolicy.DeleteBucketPolicyAction,
	iampolicy.GetBucketLocationAction,
	iampolicy.GetBucketNotificationAction,
	iampolicy.GetBucketPolicyAction,
	iampolicy.HeadBucketAction,
	iampolicy.ListAllMyBucketsAction,
	iampolicy.GetBucketPolicyStatusAction,
	iampolicy.ListBucketVersionsAction,
	iampolicy.ListBucketMultipartUploadsAction,
	iampolicy.ListenNotificationAction,
	iampolicy.ListenBucketNotificationAction,
	iampolicy.ListMultipartUploadPartsAction,
	iampolicy.PutBucketLifecycleAction,
	iampolicy.GetBucketLifecycleAction,
	iampolicy.PutBucketNotificationAction,
	iampolicy.PutBucketPolicyAction,
	iampolicy.BypassGovernanceRetentionAction,
	iampolicy.PutObjectRetentionAction,
	iampolicy.GetObjectRetentionAction,
	iampolicy.GetObjectLegalHoldAction,
	iampolicy.PutObjectLegalHoldAction,
	iampolicy.GetBucketObjectLockConfigurationAction,
	iampolicy.PutBucketObjectLockConfigurationAction,
	iampolicy.GetBucketTaggingAction,
	iampolicy.PutBucketTaggingAction,
	iampolicy.GetObjectVersionAction,
	iampolicy.GetObjectVersionTaggingAction,
	iampolicy.DeleteObjectVersionAction,
	iampolicy.DeleteObjectVersionTaggingAction,
	iampolicy.PutObjectVersionTaggingAction,
	iampolicy.GetObjectTaggingAction,
	iampolicy.PutObjectTaggingAction,
	iampolicy.DeleteObjectTaggingAction,
	iampolicy.PutBucketEncryptionAction,
	iampolicy.GetBucketEncryptionAction,
	iampolicy.PutBucketVersioningAction,
	iampolicy.GetBucketVersioningAction,
	iampolicy.GetReplicationConfigurationAction,
	iampolicy.PutReplicationConfigurationAction,
	iampolicy.ReplicateObjectAction,
	iampolicy.ReplicateDeleteAction,
	iampolicy.ReplicateTagsAction,
	iampolicy.GetObjectVersionForReplicationAction,
	iampolicy.AllActions,
)

View Source

var BucketEditorRole = iampolicy.NewActionSet(
	iampolicy.ListBucketAction,
	iampolicy.GetObjectAction,
	iampolicy.DeleteObjectAction,
	iampolicy.PutObjectAction,
)

View Source

var BucketViewerRole = iampolicy.NewActionSet(
	iampolicy.ListBucketAction,
	iampolicy.GetObjectAction,
)

Functions ¶

func GetActionsStringFromPolicy ¶

func GetActionsStringFromPolicy(policy *iampolicy.Policy) []string

GetActionsStringFromPolicy extract the admin/s3 actions from a given policy and return them in []string format

ie:

{
	"Version": "2012-10-17",
	"Statement": [{
			"Action": [
				"admin:ServerInfo",
				"admin:CreatePolicy",
				"admin:GetUser"
			],
			...
		},
		{
			"Action": [
				"s3:ListenBucketNotification",
				"s3:PutBucketNotification"
			],
			...
		}
	]
}

Will produce an array like: ["admin:ServerInfo", "admin:CreatePolicy", "admin:GetUser", "s3:ListenBucketNotification", "s3:PutBucketNotification"]\

func GetAuthorizedEndpoints ¶

func GetAuthorizedEndpoints(actions []string) []string

GetAuthorizedEndpoints return a list of allowed endpoint based on a provided *iampolicy.Policy ie: pages the user should have access based on his current privileges

func GetLDAPEnabled ¶ added in v0.6.2

func GetLDAPEnabled() bool

func GetOperatorMode ¶

func GetOperatorMode() bool

GetOperatorMode gets Console Operator mode status set on env variable or default one

Types ¶

type ConfigurationActionSet ¶

type ConfigurationActionSet struct {
	// contains filtered or unexported fields
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL