CVE-2022-31028
📋 TL;DR
MinIO object storage systems are vulnerable to a denial-of-service attack where HTTP clients can establish connections that never close, causing unending go-routine buildup that consumes system resources. Public-facing MinIO deployments are most affected, potentially leading to service degradation or unavailability. The vulnerability affects MinIO versions from RELEASE.2019-09-25T18-25-51Z through RELEASE.2022-06-02T02-11-04Z.
💻 Affected Systems
- MinIO
📦 What is this software?
Minio by Minio
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, preventing legitimate users from accessing object storage services.
Likely Case
Progressive performance degradation leading to increased latency and potential service timeouts for legitimate users.
If Mitigated
Minimal impact with proper connection limiting and monitoring in place.
🎯 Exploit Status
Exploitation requires only HTTP client access and doesn't require authentication or special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RELEASE.2022-06-02T02-11-04Z and later
Vendor Advisory: https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636
Restart Required: Yes
Instructions:
1. Backup MinIO configuration and data. 2. Stop MinIO service. 3. Download and install patched version RELEASE.2022-06-02T02-11-04Z or later. 4. Restart MinIO service. 5. Verify service is running correctly.
🔧 Temporary Workarounds
Reverse Proxy Connection Limiting
allDeploy a reverse proxy (nginx, haproxy, etc.) in front of MinIO to limit concurrent connections and actively reject connections from malicious clients.
# Example nginx configuration snippet:
# limit_conn_zone $binary_remote_addr zone=minio_limit:10m;
# limit_conn minio_limit 100;
🧯 If You Can't Patch
- Deploy a reverse proxy with connection rate limiting and monitoring
- Implement network segmentation and firewall rules to restrict access to MinIO endpoints
🔍 How to Verify
Check if Vulnerable:
Check MinIO version with 'minio version' command and compare against affected range.Check Version:
minio versionVerify Fix Applied:
Verify version is RELEASE.2022-06-02T02-11-04Z or later and monitor for abnormal go-routine growth.📡 Detection & Monitoring
Log Indicators:
- Unusual increase in active connections
- High memory consumption alerts
- Go-routine count growing without bound
Network Indicators:
- Abnormally high number of persistent HTTP connections
- Connection attempts from single sources exceeding normal patterns
SIEM Query:
source="minio" ("connection" OR "goroutine") AND ("high" OR "increase" OR "exhaust")🔗 References
- https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1
- https://github.com/minio/minio/pull/14995
- https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z
- https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636
- https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1
- https://github.com/minio/minio/pull/14995
- https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z
- https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636
