CVE-2022-35919 is a path traversal vulnerability (CWE-22) affecting MinIO, a high-performance object storage server widely used for cloud-native applications and private cloud deployments. The vulnerability exists in versions of MinIO released before 2022-07-29T19-40-48Z. Specifically, any user with 'admin' privileges authorized for the 'admin:ServerUpdate' action can exploit this flaw. By selectively triggering an error condition, the attacker can cause the server to return the contents of arbitrary filesystem paths that are readable by the MinIO process. This occurs because the pathname limitation to a restricted directory is improperly enforced, allowing traversal outside intended directories. Since MinIO runs with the privileges of its service account, the attacker can potentially access sensitive files on the host system, including configuration files, credentials, or other data accessible to the MinIO process. The vulnerability requires the attacker to have admin-level permissions with the 'admin:ServerUpdate' right, which limits exploitation to authorized users but still poses a significant risk if such credentials are compromised or misused. No known exploits are reported in the wild as of the publication date. Mitigation involves upgrading MinIO to a fixed version released after 2022-07-29 or, if upgrading is not immediately possible, disabling the ServerUpdate API by denying the 'admin:ServerUpdate' action via IAM policies to prevent exploitation. This vulnerability highlights the importance of strict access control and input validation in administrative interfaces of storage systems.

For European organizations, this vulnerability could lead to unauthorized disclosure of sensitive data stored on MinIO servers, including internal configuration files, credentials, or other critical information accessible to the MinIO process. Given MinIO's popularity in cloud-native and private cloud environments, exploitation could compromise the confidentiality and integrity of stored data. While the vulnerability does not allow remote unauthenticated attackers to gain access, the risk is significant if admin credentials are leaked or if insider threats exist. The ability to read arbitrary files could facilitate further attacks, such as lateral movement or privilege escalation within the affected environment. This could impact sectors with stringent data protection requirements, such as finance, healthcare, and government agencies in Europe, potentially leading to regulatory non-compliance and reputational damage. Availability impact is limited as the vulnerability primarily exposes data but does not directly enable denial of service. However, the indirect consequences of data leakage could be severe.

1. Immediate upgrade of MinIO installations to versions released after 2022-07-29T19-40-48Z where the vulnerability is patched. 2. For environments where immediate upgrade is not feasible, explicitly deny the 'admin:ServerUpdate' action in IAM policies for all admin users to disable the vulnerable ServerUpdate API endpoint. 3. Conduct a thorough review of admin user privileges to ensure that only trusted personnel have 'admin:ServerUpdate' rights, minimizing the attack surface. 4. Implement monitoring and alerting on unusual admin API calls, especially those targeting ServerUpdate endpoints, to detect potential exploitation attempts. 5. Regularly audit MinIO server logs and system logs for anomalous file access patterns that could indicate exploitation. 6. Employ network segmentation and strict access controls to limit administrative access to MinIO servers. 7. Educate administrators on the risks of credential compromise and enforce strong authentication mechanisms, such as multi-factor authentication, for admin accounts. 8. Consider deploying host-based intrusion detection systems to monitor unauthorized file access on servers running MinIO.