CVE-2023-28434highunder attackCWE-269

CVE-2023-28434: high-severity vulnerability in minio

MinIO is vulnerable to privilege escalation on Linux/MacOS

Published · Updated

Follow this CVE+ Monitor minio+ Monitor github.com/minio/minio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 7.9%
from disclosure to weapon1 day
Published on NVDMar 22
1st PoC+1d
CISA KEV+181d
Action required by CISAfederal deadline: 2023-10-10

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

MinIO has a flaw that lets attackers with certain permissions bypass bucket protection and place files in any storage bucket they shouldn't access. This happens through specially crafted requests that trick the security checks, and it only works if the attacker already has broad permissions and the Console API is enabled.

Technical detail

The vulnerability exists in PostPolicyBucket processing where metadata bucket name validation can be bypassed via crafted requests (CWE-269: Improper Access Control). An authenticated attacker with `arn:aws:s3:::*` permissions and enabled Console API access can write objects to arbitrary buckets. The flaw was patched in RELEASE.2023-03-20T20-16-18Z.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
minio · minio
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — minio

In the same product, most dangerous first.

CVE-2023-28432HIGHMinio Information Disclosure in Cluster DeploymentEPSS 84.0%KEVCVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2021-43858HIGHUser privilege escalation in MinIOEPSS 35.5%CVE-2024-24747HIGHMinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationEPSS 34.1%CVE-2021-21287HIGHServer-Side Request Forgery in MinIO Browser APIEPSS 23.9%CVE-2026-42600MEDIUMMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointEPSS 8.7%