CVE-2023-28432highunder attackCWE-200

CVE-2023-28432: high-severity vulnerability in minio

Minio Information Disclosure in Cluster Deployment

Published · Updated

Follow this CVE+ Monitor minio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 84%
from disclosure to weapon1 day
Published on NVDMar 22
1st PoC+1d
metasploitMar 20
CISA KEV+30d
Action required by CISAfederal deadline: 2023-05-12

Apply updates per vendor instructions.

In short

MinIO in cluster mode was leaking sensitive environment variables, including secret keys and root passwords, to unauthorized users. This allows attackers to gain full access to the storage system.

Technical detail

Information disclosure vulnerability in MinIO cluster deployments (RELEASE.2019-12-17T23-16-33Z through RELEASE.2023-03-20T20-16-18Z) where environment variables containing credentials (MINIO_SECRET_KEY, MINIO_ROOT_PASSWORD) are exposed via API responses or logs without proper access controls. Exploitation requires network access to the MinIO cluster endpoints.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
minio · minio
public PoCs found — 35
githubgithub.com/MzzdToT/CVE-2023-28432★ 37githubgithub.com/Mr-xn/CVE-2023-28432★ 34githubgithub.com/acheiii/CVE-2023-28432★ 15githubgithub.com/Chocapikk/CVE-2023-28432★ 11githubgithub.com/Cuerz/CVE-2023-28432★ 10githubgithub.com/gobysec/CVE-2023-28432★ 10githubgithub.com/Okaytc/minio_unauth_check★ 7githubgithub.com/yTxZx/CVE-2023-28432★ 3githubgithub.com/BitWiz4rd/CVE-2023-28432★ 2githubgithub.com/steponeerror/Cve-2023-28432-★ 2githubgithub.com/unam4/CVE-2023-28432-minio_update_rce★ 1githubgithub.com/TaroballzChen/CVE-2023-28432-metasploit-scanner★ 1githubgithub.com/C1ph3rX13/CVE-2023-28432★ 1githubgithub.com/LHXHL/Minio-CVE-2023-28432★ 1githubgithub.com/h0ng10/CVE-2023-28432_docker★ 0githubgithub.com/CHINA-china/MinIO_CVE-2023-28432_EXP★ 0githubgithub.com/NET-Flowers/CVE-2023-28432★ 0vulncheckvulncheck.com/xdb/362042b30e53unverifiedvulncheckvulncheck.com/xdb/01d4efe0d336unverifiedvulncheckvulncheck.com/xdb/6aacf8dccab7unverifiedvulncheckvulncheck.com/xdb/fbd103314ef8unverifiedvulncheckvulncheck.com/xdb/f8d3bffd0b5funverifiedvulncheckvulncheck.com/xdb/b5a191fe1548unverifiedvulncheckvulncheck.com/xdb/ce019ea1d113unverifiedvulncheckvulncheck.com/xdb/3fa0cfa7912aunverifiedvulncheckvulncheck.com/xdb/2f2181c8c371unverifiedvulncheckvulncheck.com/xdb/c098a3a1e4d1unverifiedvulncheckvulncheck.com/xdb/135cba389f2dunverifiedvulncheckvulncheck.com/xdb/265e34c2d00bunverifiedvulncheckvulncheck.com/xdb/b03d61e273cdunverifiedvulncheckvulncheck.com/xdb/2bce5ce3653dunverifiedvulncheckvulncheck.com/xdb/8a90a12dbb9dunverifiedvulncheckvulncheck.com/xdb/88c33874c8a8unverifiedvulncheckvulncheck.com/xdb/b297acbd5c68unverifiedvulncheckvulncheck.com/xdb/ddf25a501579unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — minio

In the same product, most dangerous first.

CVE-2023-28434HIGHMinIO is vulnerable to privilege escalation on Linux/MacOSEPSS 7.9%KEVCVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2021-43858HIGHUser privilege escalation in MinIOEPSS 35.5%CVE-2024-24747HIGHMinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationEPSS 34.1%CVE-2021-21287HIGHServer-Side Request Forgery in MinIO Browser APIEPSS 23.9%CVE-2026-42600MEDIUMMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointEPSS 8.7%