PT-2022-20472 · Minio+1 · Minio+1

Harshavardhana · Published 2022-06-03 · Updated 2024-12-26 · CVE-2022-31028

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2019-09-25T18-25-51Z through RELEASE.2022-06-02T02-11-04Z

Description The issue is related to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected.

Recommendations For versions RELEASE.2019-09-25T18-25-51Z through RELEASE.2022-06-02T02-11-04Z, upgrade to RELEASE.2022-06-02T02-11-04Z or later to receive a patch. As a temporary workaround, consider using a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from malicious clients.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2022-3382

ALT-PU-2023-1522

ALT-PU-2023-1908

ALT-PU-2023-2074

ALT-PU-2024-17529

BIT-MINIO-2022-31028

CVE-2022-31028

GHSA-QRPR-R3PW-F636

Affected Products

Alt Linux

Minio

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31028.json · Exploit
• 🔥 https://github.com/MzzdToT/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2023-28432 · Exploit
• 🔥 https://github.com/acheiii/CVE-2023-28432 · Exploit
• 🔥 https://github.com/0rx1/cve-2021-43858 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-28432 · Exploit
• 🔥 https://github.com/yTxZx/CVE-2023-28432 · Exploit
• 🔥 https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1 · Exploit
• https://github.com/minio/minio/pull/14995 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31028 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31028 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-minio-2022-31028 · Vendor Advisory