CVE-2023-28434: MinIO Security Feature Bypass Vulnerability
Impact An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3::: permission, as well as enabled Console API access.
Patches commit 67f4ba154a27a1b06e48bfabda38355a010dfca5 Author: Aditya Manthramurthy <donatello@users.noreply.github.com> Date: Sun Mar 19 21:15:20 2023 -0700
fix: post policy request security bypass (#16849)
Workarounds Browser API access must be enabled turning off MINIOBROWSER=off allows for this workaround.
References The vulnerable code: go // minio/cmd/generic-handlers.go func setRequestValidityHandler(h http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { // ... // For all other requests reject access to reserved buckets bucketName, := request2BucketObjectName(r) if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) { if !guessIsRPCReq(r) && !guessIsBrowserReq(r) && !guessIsHealthCheckReq(r) && !guessIsMetricsReq(r) && !isAdminReq(r) && !isKMSReq(r) { if ok { tc.FuncName = "handler.ValidRequest" tc.ResponseRecorder.LogErrBody = true } writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL) return } } // ...
Other sources
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket to conduct privilege escalation. To carry out this attack, the attacker requires credentials with arn:aws:s3::: permission, as well as enabled Console API access.
— CISA
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3::: permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off MINIOBROWSER=off.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/minio/minioto a version that resolves this vulnerability.Fixed in 0.0.0-202303200415 - Upgrade
Upgrade
go/github.com/minio/minioto a version that resolves this vulnerability.Fixed in RELEASE.2023-03-20T20-16-18Z - Configuration
Enable browser API access and turn off MINIO_BROWSER=off.
MinIO MINIO_BROWSER = off
Event History
Frequently Asked Questions
What is the impact of CVE-2023-28434?
An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.
How can an attacker exploit CVE-2023-28434?
The attacker can use crafted requests and bypass metadata bucket name checking to put an object into any bucket.
What permissions do attackers need to exploit CVE-2023-28434?
Attackers require credentials with `arn:aws:s3:::*` permission and enabled Console API access.
What is the severity of CVE-2023-28434?
The severity of CVE-2023-28434 is high with a CVSS score of 8.8.
Where can I find more information about CVE-2023-28434?
You can find more information about CVE-2023-28434 in the following references: [GitHub Advisory](https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-28434), [GitHub Pull Request](https://github.com/minio/minio/pull/16849)