CVE-2022-35919

This exploit leverages a path traversal vulnerability in Minio (CVE-2022-35919) to read the contents of /etc/passwd by sending a crafted POST request to the admin update endpoint. It uses AWS Signature Version 4 for authentication and parses the response to extract user data.

This PoC exploits a path traversal vulnerability in Minio's admin API to read arbitrary files (e.g., /etc/passwd) by crafting authenticated requests with AWS Signature V4 signing. It demonstrates the vulnerability by parsing and displaying the contents of the targeted file.

This repository contains a functional exploit PoC for CVE-2022-35919, which targets Minio's admin API to leak the contents of /etc/passwd. The script constructs a malicious URL, signs it with AWS Signature V4, and sends a POST request to trigger the vulnerability.