High severity · published Mar 22, 2023
CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
In wildKEV
8.8
CVSS
7.9%
EPSS
Yes
On KEV
Description
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.9% · higher than 95% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 19, 2023
Federal remediation dueOct 10, 2023
Ransomware campaign useNot known
Affected products
Which versions
MI
minio · minio
< RELEASE.2023-03-20T20-16-18Z · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28434
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28434
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c
x_refsource_MISC
https://github.com/minio/minio/pull/16849
x_refsource_MISC
https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5
More from minio
7.5
CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
9.8
CVE-2026-33322
MinIO: JWT Algorithm Confusion in OIDC Authentication
9.3
CVE-2024-55949
Privilege escalation in IAM import API in MinIO
8.8
CVE-2024-24747
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
8.8
CVE-2023-28433
Minio Privilege Escalation on Windows via Path separator manipulation