PT-2023-4759 · Minio+2 · Minio+2

Donatello · Published 2023-03-21 · Updated 2026-02-26 · CVE-2023-28434

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2023-03-20T20-16-18Z

Description MinIO, a Multi-Cloud Object Storage framework, contains a security flaw within the PostPolicyBucket component related to privilege management errors. An attacker with arn:aws:s3:::* permissions and enabled Console API access can exploit this issue by sending specially crafted HTTP requests to bypass metadata bucket name checking and place objects into any bucket. This could potentially lead to privilege escalation. There is no information available regarding the number of affected devices or real-world exploitation of this issue. The vulnerable code resides in minio/cmd/generic-handlers.go within the setRequestValidityHandler function. The PostPolicyBucket component is susceptible to bypass due to improper handling of bucket name validation.

Recommendations Upgrade to RELEASE.2023-03-20T20-16-18Z or later. As a temporary workaround, enable browser API access and turn off MINIO BROWSER=off.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

ALT-PU-2023-1522

ALT-PU-2023-1908

ALT-PU-2023-2074

ALT-PU-2024-17529

BDU:2023-05199

BIT-MINIO-2023-28434

CVE-2023-28434

GHSA-2PXW-R47W-4P8C

Affected Products

Alt Linux

Minio

Red Os

References · 51

• 🔥 https://github.com/minio/minio/pull/16849 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28434.json · Exploit
• 🔥 https://github.com/AbelChe/evil_minio · Exploit
• https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 · Patch
• https://cve.org/CVERecord?id=CVE-2023-28434 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28434 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28434 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-minio-2023-28434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2pxw-r47w-4p8c · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28434 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05199 · Security Note
• https://github.com/minio/minio · Note
• https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c · Security Note, Vendor Advisory