Vulnerability · Published Jun 3, 2022 · Assigned by GitHub_M

CVE-2022-31028Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

High 7.5

In plain English

A high-severity uncontrolled resource consumption in minio from minio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)3.0%top 12.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

Affected products (as reported)

Vendor	Product	Versions
minio	minio	>= RELEASE.2019-09-25T18-25-51Z, < RELEASE.2022-06-02T02-11-04Z

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636 x_refsource_CONFIRM
https://github.com/minio/minio/pull/14995 x_refsource_MISC
https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1 x_refsource_MISC
https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z x_refsource_MISC