CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOS
Explotación conocida — MinIO Security Feature Bypass Vulnerability
CISA confirmó el 19.09.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 10.10.2023.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c; https://nvd.nist.gov/vuln/detail/CVE-2023-28434
Descripción
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c Vendor Advisory
- https://github.com/minio/minio/pull/16849 ExploitIssue Tracking
- https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 Patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*< 2023-03-20t20-16-18z