MinIO · MinIO
CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
What it is
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
CISA: MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 12, 2023
- Added to the CISA list
- April 21, 2023
- Published
- March 22, 2023
- Severity
- High 7.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 84% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-200
- More details
- NVD · CVE.org · CISA
All references (5)
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
- https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
- https://twitter.com/Andrew___Morris/status/1639325397241278464
- https://viz.greynoise.io/tag/minio-information-disclosure-attempt
- https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-…
More exploited flaws from MinIO
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 19, 2023 | Security Feature Bypass | MinIO | High 8.8 | 7.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.