Actively exploited · Published Mar 22, 2023 · Assigned by GitHub_M
CVE-2023-28432Minio Information Disclosure in Cluster Deployment
High 7.5 Exploited
In plain English
A high-severity information exposure in minio from minio. Attackers are actively exploiting it in the wild (listed by CISA on April 21, 2023). The chance it is exploited in the next 30 days is estimated at 84.0% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 12, 2023.
Official description
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q x_refsource_CONFIRM
- https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z x_refsource_MISC
- https://twitter.com/Andrew___Morris/status/1639325397241278464
- https://viz.greynoise.io/tag/minio-information-disclosure-attempt
- https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432 government-resource