Vulnerability · Published Mar 22, 2023 · Assigned by GitHub_M

CVE-2023-28433Minio Privilege Escalation on Windows via Path separator manipulation

High 8.8

In plain English

A high-severity security flaw in minio from minio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/minio/minio	0.0.0-202303200735	GHSA-w23q-4hw3-2pp6

Affected products (as reported)

Vendor	Product	Versions
minio	minio	< RELEASE.2023-03-20T20-16-18Z

Weakness: CWE-668 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6 x_refsource_CONFIRM
https://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8 x_refsource_MISC
https://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc x_refsource_MISC
https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z x_refsource_MISC