Minio <RELEASE.2023-03-20T20-16-18Z - Auth Bypass
Title source: llmExploitation Summary
CVE-2023-28434 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 19, 2023. EIP tracks 2 public exploits from researchers including AbelChe.
AI-analyzed exploit summary The repository appears to be a fork of the MinIO project with no explicit exploit code or technical analysis related to CVE-2023-28434. It contains standard project files (Dockerfile, Makefile, compliance docs) but lacks any PoC or vulnerability details.
Description
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
Exploits (2)
The repository appears to be a fork of the MinIO project with no explicit exploit code or technical analysis related to CVE-2023-28434. It contains standard project files (Dockerfile, Makefile, compliance docs) but lacks any PoC or vulnerability details.
This repository contains a functional Nuclei template for CVE-2023-28432, which exploits an information disclosure vulnerability in MinIO cluster deployments. The exploit sends a POST request to the `/minio/bootstrap/v1/verify` endpoint to retrieve sensitive environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H