CVE-2023-28434: MinIO Security Feature Bypass Vulnerability

Vulnerability summary

CVE-2023-28434 is a high (CVSS 8.8) Improper Privilege Management vulnerability in MinIO. It is known to be exploited: CISA lists it, first on 19-09-2023. EPSS estimates a 7.92% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-03-2023
   PublishedVulnerability first disclosed.
2. 19-09-2023
   Added to CISA KEVExploitedMinIO Security Feature Bypass Vulnerability
3. 10-10-2023
   CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.