CVE-2023-28432
📋 TL;DR
MinIO distributed deployments expose all environment variables including sensitive credentials like MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD through an information disclosure vulnerability. This affects all users of distributed MinIO deployments running vulnerable versions. Attackers can obtain administrative credentials leading to complete cluster compromise.
💻 Affected Systems
- MinIO
📦 What is this software?
Minio by Minio
⚠️ Risk & Real-World Impact
Worst Case
Full cluster compromise with administrative access, allowing data theft, data destruction, or deployment of ransomware across all stored objects.
Likely Case
Credential theft leading to unauthorized access to stored data, potential data exfiltration, and lateral movement within the storage infrastructure.
If Mitigated
Limited impact if strong network segmentation and access controls prevent external access to the vulnerable endpoint.
🎯 Exploit Status
Simple HTTP request to exposed endpoint returns all environment variables. Actively exploited in the wild as indicated by GreyNoise data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RELEASE.2023-03-20T20-16-18Z
Vendor Advisory: https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Stop MinIO service. 3. Upgrade to RELEASE.2023-03-20T20-16-18Z or later. 4. Restart MinIO service. 5. Rotate all exposed credentials (MINIO_SECRET_KEY, MINIO_ROOT_PASSWORD, etc.).
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to MinIO management endpoints using firewall rules
iptables -A INPUT -p tcp --dport 9000 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
🧯 If You Can't Patch
- Immediately rotate all MinIO credentials (MINIO_SECRET_KEY, MINIO_ROOT_PASSWORD, and any other sensitive environment variables)
- Implement strict network segmentation to limit access to MinIO management endpoints only to trusted administrative networks
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to MinIO endpoint (typically port 9000) and check if environment variables are returned in response. Vulnerable versions will expose MINIO_SECRET_KEY and other credentials.Check Version:
minio versionVerify Fix Applied:
After patching, attempt the same HTTP request - patched versions should not return environment variables. Verify version is RELEASE.2023-03-20T20-16-18Z or later.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to MinIO management endpoints
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- HTTP requests to MinIO endpoints from unexpected IP addresses
- Traffic patterns suggesting credential harvesting
SIEM Query:
source="minio" AND (url_path="/minio/admin/v3/info" OR response_contains="MINIO_SECRET_KEY")🔗 References
- https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
- https://twitter.com/Andrew___Morris/status/1639325397241278464
- https://viz.greynoise.io/tag/minio-information-disclosure-attempt
- https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
- https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
- https://twitter.com/Andrew___Morris/status/1639325397241278464
- https://viz.greynoise.io/tag/minio-information-disclosure-attempt
- https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432
