Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
SummaryWhen someone creates an access key, it inherits the permissions of the parent key. Not only for 
`s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the 
access-key hierarchy, the `admin` rights are denied, access keys will be able to simply 
override their own `s3` permissions to something more permissive.Credit to @xSke for sort of accidentally discovering this. I only understood the implications.Details / PoCWe spun up the latest version of minio in a docker container and signed in to the admin UI 
using the minio root user. We created two buckets, `public` and `private` and created an 
access key called `mycat` and attached the following policy to only allow access to the 
bucket called `public`.We then set an alias in mc:  `mcli alias set vuln http://localhost:9001 mycat mycatiscute`And checked whether policy works:Looks good, we believe this is how 99% of users will work with access policies.If I now create a file `full-access-policy.json`:And then:`mycat` has escalated its privileges to get access to the entire deployment:ImpactA trivial privilege escalation unless the operator fully understands that they need to 
explicitly deny `admin` actions on access keys.Patched