PT-2022-23025 · Minio+1 · Minio+1

Alevsk · Published 2022-07-29 · Updated 2024-12-26 · CVE-2022-35919

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MinIO (affected versions not specified)

Description The issue affects MinIO, a High Performance Object Storage, where admin users authorized for admin:ServerUpdate can trigger an error that returns the content of the requested path. This allows access to contents at arbitrary paths readable by the MinIO process.

Recommendations For all affected versions, users are advised to upgrade. As a temporary workaround, consider disabling the ServerUpdate API by denying the admin:ServerUpdate action for admin users via IAM policies.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2022-3382

ALT-PU-2023-1522

ALT-PU-2023-1908

ALT-PU-2023-2074

ALT-PU-2024-17529

BIT-MINIO-2022-35919

CVE-2022-35919

GHSA-GR9V-6PCM-RQVG

Affected Products

Alt Linux

Minio

References · 19

• 🔥 https://github.com/minio/minio/security/advisories/GHSA-gr9v-6pcm-rqvg · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35919.json · Exploit
• 🔥 https://github.com/MzzdToT/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2023-28432 · Exploit
• 🔥 https://github.com/acheiii/CVE-2023-28432 · Exploit
• 🔥 https://github.com/0rx1/cve-2021-43858 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-28432 · Exploit
• 🔥 https://github.com/yTxZx/CVE-2023-28432 · Exploit
• 🔥 https://exploit-db.com/exploits/51734 · Exploit
• https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692 · Patch
• https://github.com/minio/minio/pull/15429 · Patch
• https://osv.dev/vulnerability/CVE-2022-35919 · Vendor Advisory