HIGH

CVE-2023-28432

Minio Minio 2023-03-22 CVSS v3.1

CVSS

7.5

KEV

Description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Summary dbcve.org

In MinIO cluster deployments from RELEASE.2019-12-17T23-16-33Z through RELEASE.2023-03-20T20-16-18Z, the /minio/v2/info/credentials endpoint (or similar diagnostic endpoints) returns all environment variables including the sensitive MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, exposing credentials to anyone with API access.

Mitigation

Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later. If immediate upgrade is not possible, restrict network access to MinIO endpoints and rotate any exposed credentials immediately.

Proof of Concept

Weakness (CWE)

CWE-200 Information Exposure

EPSS Score

83.96%

Probability of exploitation in next 30 days

99.7th percentile

References

https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z Release Notes https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q Exploit, Vendor Advisory https://twitter.com/Andrew___Morris/status/1639325397241278464 Third Party Advisory https://viz.greynoise.io/tag/minio-information-disclosure-attempt Third Party Advisory https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE