Actively exploited · Published Mar 22, 2023 · Assigned by GitHub_M
CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOS
High 8.8 Exploited
In plain English
A high-severity privilege mismanagement in minio from minio. Attackers are actively exploiting it in the wild (listed by CISA on September 19, 2023). The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 10, 2023.
Official description
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/minio/minio | 0.0.0-202303200415 | GHSA-2pxw-r47w-4p8c |
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c x_refsource_CONFIRM
- https://github.com/minio/minio/pull/16849 x_refsource_MISC
- https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434 government-resource