PT-2023-2333 · Minio+2 · Minio+2

Ricterz · Published 2022-02-03 · Updated 2026-03-01 · CVE-2023-28432

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Minio versions prior to RELEASE.2023-03-20T20-16-18Z Minio version 2022.02.01-alt1 Minio version 2022.12.07-alt1 Minio version 2023.05.18-alt1 Minio version 2023.10.16-alt1 Minio version 2023.03.24-alt1

Description MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO SECRET KEY and MINIO ROOT PASSWORD, resulting in information disclosure. This impacts all users of distributed deployments. Reports indicate this issue has been exploited in the wild, including a breach at Straumann Group, where sensitive data was exposed through an unsecured MinIO instance. The vulnerability allows attackers to potentially gain access to sensitive credentials. A POST request to the /minio/bootstrap/v1/verify endpoint can reveal these secrets. Approximately 105,895 systems are potentially exposed according to ZoomEye data.

Recommendations Upgrade to RELEASE.2023-03-20T20-16-18Z or later. Upgrade to version 2022.02.01-alt1. Upgrade to version 2022.12.07-alt1. Upgrade to version 2023.05.18-alt1. Upgrade to version 2023.10.16-alt1. Upgrade to version 2023.03.24-alt1.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2022-1206

ALT-PU-2022-3382

ALT-PU-2023-1522

ALT-PU-2023-1908

ALT-PU-2023-2074

ALT-PU-2024-17529

BDU:2023-02098

BIT-MINIO-2023-28432

CVE-2023-28432

GHSA-6XVQ-WJ2X-3H3Q

Affected Products

Alt Linux

Minio

Red Os

References · 71

• 🔥 https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/minio_bootstrap_verify_info_disc.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28432.json · Exploit
• 🔥 https://github.com/MzzdToT/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2023-28432 · Exploit
• 🔥 https://github.com/acheiii/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2023-28432 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-28432 · Exploit
• 🔥 https://github.com/Okaytc/minio_unauth_check · Exploit
• 🔥 https://github.com/yTxZx/CVE-2023-28432 · Exploit
• https://ubuntu.com/security/CVE-2023-28432 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/692166 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-28432 · Security Note