nomisec
WORKING POC
36 stars
by MzzdToT · infoleak
https://github.com/MzzdToT/CVE-2023-28432
This repository contains a functional Python script that exploits CVE-2023-28432, an information disclosure vulnerability in MinIO. The exploit sends a crafted HTTP POST request to the `/minio/bootstrap/v1/verify` endpoint to leak environment variables, including sensitive credentials like `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 95%
Target:
MinIO (version not specified)
No auth needed
Prerequisites:
Network access to the MinIO server · MinIO server exposed on the internet or internal network
nomisec
WORKING POC
33 stars
by Mr-xn · infoleak
https://github.com/Mr-xn/CVE-2023-28432
This repository contains a functional Nuclei template for CVE-2023-28432, which exploits an information disclosure vulnerability in MinIO's cluster deployment. The exploit sends a POST request to the `/minio/bootstrap/v1/verify` endpoint to retrieve sensitive environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 95%
Target:
MinIO (RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z)
No auth needed
Prerequisites:
Network access to the MinIO server · MinIO cluster deployment
nomisec
WORKING POC
14 stars
by acheiii · infoleak
https://github.com/acheiii/CVE-2023-28432
The repository contains a functional PoC for CVE-2023-28432, an information disclosure vulnerability in MinIO. The script sends a POST request to the `/minio/bootstrap/v1/verify` endpoint and checks for the presence of sensitive environment variables (`MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`) in the response.
Classification
Working Poc 95%
Target:
MinIO (RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z)
No auth needed
Prerequisites:
Network access to the MinIO server · Target server running a vulnerable version of MinIO
nomisec
SCANNER
10 stars
by Cuerz · infoleak
https://github.com/Cuerz/CVE-2023-28432
This repository contains a Go-based scanner for detecting CVE-2023-28432, a MinIO sensitive information disclosure vulnerability. It sends a POST request to the '/minio/bootstrap/v1/verify' endpoint and checks for a 200 OK response to determine if the target is vulnerable.
Classification
Scanner 95%
Target:
MinIO
No auth needed
Prerequisites:
Network access to the MinIO server
nomisec
SUSPICIOUS
10 stars
by gobysec · poc
https://github.com/gobysec/CVE-2023-28432
The repository lacks actual exploit code and instead provides vague descriptions and external links, which is characteristic of a social engineering lure. No technical details or PoC code are included.
Classification
Suspicious 90%
Target:
MinIO (version not specified)
No auth needed
Prerequisites:
Access to MinIO verify interface
nomisec
WORKING POC
7 stars
by Chocapikk · remote
https://github.com/Chocapikk/CVE-2023-28432
This repository contains a functional Python exploit for CVE-2023-28432, which targets Minio's environment variable disclosure vulnerability. The script sends a POST request to the `/minio/bootstrap/v1/verify` endpoint and extracts sensitive environment variables like `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 95%
Target:
Minio (RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z)
No auth needed
Prerequisites:
Python 3.x · requests library · rich library · alive_progress library · Leakix API key (optional for URL discovery)
nomisec
SCANNER
7 stars
by Okaytc · infoleak
https://github.com/Okaytc/minio_unauth_check
This repository contains a Python script that checks for the presence of CVE-2023-28432, an information disclosure vulnerability in MinIO. The script sends a POST request to a specific endpoint and checks the response for indicators of the vulnerability.
Classification
Scanner 95%
Target:
MinIO
No auth needed
Prerequisites:
Network access to the MinIO server
nomisec
WORKING POC
3 stars
by yTxZx · remote
https://github.com/yTxZx/CVE-2023-28432
This script exploits CVE-2023-28432, an information disclosure vulnerability in MinIO, by sending a POST request to the '/minio/bootstrap/v1/verify' endpoint to leak MINIO_ROOT_USER and MINIO_ROOT_PASSWORD credentials. It supports both single URL and batch file processing, with results exported to an Excel file.
Classification
Working Poc 95%
Target:
MinIO (version not specified)
No auth needed
Prerequisites:
Network access to the MinIO server · Exposed '/minio/bootstrap/v1/verify' endpoint
nomisec
SCANNER
2 stars
by steponeerror · infoleak
https://github.com/steponeerror/Cve-2023-28432-
This repository contains a Python script that scans for CVE-2023-28432, an information disclosure vulnerability in MinIO. It checks for the presence of sensitive environment variables (MINIO_ROOT_PASSWORD and MINIO_ROOT_USER) in the response from the MinIO API endpoint.
Classification
Scanner 90%
Target:
MinIO (versions affected by CVE-2023-28432)
No auth needed
Prerequisites:
List of target MinIO API endpoints in a file named 'targets.txt'
nomisec
WORKING POC
1 stars
by BitWiz4rd · remote
https://github.com/BitWiz4rd/CVE-2023-28432
The repository contains a functional Python script that exploits CVE-2023-28432 in MinIO by sending a crafted POST request to the `/minio/bootstrap/v1/verify` endpoint to leak sensitive environment variables. The exploit is straightforward and demonstrates the vulnerability effectively.
Classification
Working Poc 95%
Target:
MinIO (specific version not specified)
No auth needed
Prerequisites:
Network access to the MinIO server · MinIO server exposed to the internet or accessible via the specified endpoint
nomisec
WORKING POC
1 stars
by xk-mt · infoleak
https://github.com/xk-mt/CVE-2023-28432
This repository contains a functional Python script that exploits CVE-2023-28432, an information disclosure vulnerability in MinIO. The exploit sends a crafted POST request to the `/minio/bootstrap/v1/verify` endpoint to retrieve sensitive environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 95%
Target:
MinIO (version not specified)
No auth needed
Prerequisites:
Network access to the MinIO server · MinIO server exposed on port 9000
nomisec
SCANNER
1 stars
by netuseradministrator · infoleak
https://github.com/netuseradministrator/CVE-2023-28432
This repository contains a Go-based GUI tool that checks for CVE-2023-28432, a MinIO information disclosure vulnerability. It sends a POST request to the `/minio/bootstrap/v1/verify` endpoint and analyzes the response to determine vulnerability status.
Classification
Scanner 90%
Target:
MinIO (versions affected by CVE-2023-28432)
No auth needed
Prerequisites:
Network access to the MinIO server
nomisec
WORKING POC
1 stars
by C1ph3rX13 · remote
https://github.com/C1ph3rX13/CVE-2023-28432
This repository contains a functional exploit for CVE-2023-28432, an information disclosure vulnerability in MinIO. The script sends a POST request to a specific endpoint to retrieve MinIO environment variables, including root credentials.
Classification
Working Poc 95%
Target:
MinIO (versions affected by CVE-2023-28432)
No auth needed
Prerequisites:
Target MinIO instance accessible via HTTP/HTTPS
nomisec
SUSPICIOUS
1 stars
by unam4 · poc
https://github.com/unam4/CVE-2023-28432-minio_update_rce
The repository lacks actual exploit code and instead redirects to external sources (GitHub and Yuque) for details. It mentions a backdoor mechanism but provides no technical implementation or analysis.
Classification
Suspicious 90%
Target:
MinIO (versions 2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z)
No auth needed
Prerequisites:
Access to a vulnerable MinIO instance
nomisec
SCANNER
1 stars
by TaroballzChen · remote
https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner
This repository contains a Metasploit auxiliary module that scans for CVE-2023-28432, an information disclosure vulnerability in MinIO. The script checks for the presence of sensitive environment variables by sending a crafted request to the vulnerable endpoint.
Classification
Scanner 95%
Target:
MinIO (versions affected by CVE-2023-28432)
No auth needed
Prerequisites:
Network access to the MinIO instance · MinIO instance exposed on the network
nomisec
SCANNER
1 stars
by LHXHL · remote
https://github.com/LHXHL/Minio-CVE-2023-28432
This repository contains a Go-based scanner for detecting CVE-2023-28432, an information disclosure vulnerability in MinIO. The tool sends a POST request to the '/minio/bootstrap/v1/verify' endpoint and checks for the presence of 'MinioEnv' in the response to determine vulnerability.
Classification
Scanner 95%
Target:
MinIO (version not specified)
No auth needed
Prerequisites:
Network access to the MinIO server · MinIO server exposed on the network
nomisec
WORKING POC
by NET-Flowers · poc
https://github.com/NET-Flowers/CVE-2023-28432
This repository contains a JavaFX-based tool for detecting and exploiting CVE-2023-28432, a sensitive information disclosure vulnerability in MinIO. The tool sends a crafted POST request to the `/minio/bootstrap/v1/verify` endpoint to leak environment variables like `MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 90%
Target:
MinIO (cluster mode)
No auth needed
Prerequisites:
Network access to MinIO instance · MinIO running in cluster mode
nomisec
WORKING POC
by CHINA-china · infoleak
https://github.com/CHINA-china/MinIO_CVE-2023-28432_EXP
This Python script exploits CVE-2023-28432, an information disclosure vulnerability in MinIO, by sending a crafted POST request to the `/minio/bootstrap/v1/verify` endpoint to leak root credentials (MINIO_ROOT_USER/PASSWORD or MINIO_ACCESS_KEY/SECRET_KEY). It supports both single URL and bulk file input with multithreading for efficiency.
Classification
Working Poc 95%
Target:
MinIO (versions affected by CVE-2023-28432)
No auth needed
Prerequisites:
Network access to the MinIO server · Exposed `/minio/bootstrap/v1/verify` endpoint
nomisec
WORKING POC
by h0ng10 · poc
https://github.com/h0ng10/CVE-2023-28432_docker
This repository provides Docker Compose configurations to test CVE-2023-28432, an information disclosure vulnerability in MinIO clusters. It includes vulnerable and non-vulnerable setups to demonstrate the issue.
Classification
Working Poc 90%
Target:
MinIO (versions before RELEASE.2023-04-07T05-28-58Z)
No auth needed
Prerequisites:
Docker environment · MinIO cluster setup
metasploit
WORKING POC
by joel @ ndepthsecurity, RicterZ · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb
This Metasploit module exploits an information disclosure vulnerability in MinIO (CVE-2023-28432) by sending a POST request to the `/minio/bootstrap/v1/verify` endpoint, which returns environment variables including sensitive credentials like `MINIO_ROOT_PASSWORD`.
Classification
Working Poc 100%
Target:
MinIO (RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z)
No auth needed
Prerequisites:
Network access to MinIO instance on port 9000