Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. An attacker is able to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To achieve this, the attacker needs credentials with arn:aws:s3:::* permission and Console API access. To mitigate this, enable browser API access and turn off MINIO_BROWSER=off. Note that minio is affected only if its running on Linux or Mac.