CVE-2023-28434

HIGH KEV LAB

Minio <RELEASE.2023-03-20T20-16-18Z - Auth Bypass

Title source: llm

Description

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Exploits (2)

nomisec STUB 319 stars
by AbelChe · remote-auth
https://github.com/AbelChe/evil_minio
vulncheck_xdb WORKING POC
infoleak
https://github.com/Mr-xn/CVE-2023-28434

References (4)

Scores

CVSS v3 8.8
EPSS 0.5209
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull minio/minio:latest
docker pull quay.io/minio/minio:RELEASE.2023-03-24T21-41-23Z

Details

CISA KEV 2023-09-19
VulnCheck KEV 2023-09-04
InTheWild.io 2023-09-19
ENISA EUVD EUVD-2023-2395
CWE
CWE-269
Status published
Products (2)
minio/minio < 2023-03-20t20-16-18z
minio/minio 0 - 0.0.0-202303200415Go
Published Mar 22, 2023
KEV Added Sep 19, 2023
Tracked Since Feb 18, 2026