Minio Information Disclosure in Cluster Deployment
Affects MinIO cluster (distributed) deployments from RELEASE.2019-12-17T23-16-33Z up to, but not including, RELEASE.2023-03-20T20-16-18Z, which is the release that fixes it.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in RELEASE.2023-03-20T20-16-18Z
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MinIO, a multi-cloud object storage framework, is affected when it runs in a distributed cluster deployment. In affected versions, the server can leak all of its environment variables, including sensitive credentials such as the secret key and root password, to unauthorized parties.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- minio minio
From RELEASE.2019-12-17T23-16-33Z · fixed in RELEASE.2023-03-20T20-16-18Z
References 5
GitHub · minio/minio
twitter.com
viz.greynoise.io
Questions about CVE-2023-28432
What does this mean?
In a cluster deployment, MinIO returns all of its environment variables, which is an information disclosure flaw. The advisory's wording is limited to that behavior.Source: github.com
Am I affected, and how do I check?
Cluster (distributed) deployments of MinIO in releases from RELEASE.2019-12-17T23-16-33Z up to, but not including, RELEASE.2023-03-20T20-16-18Z. To check a deployment, compare its MinIO release tag with that range and confirm whether it runs as a distributed cluster.Source: github.com
What should I do about it?
Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-04-21, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data