CVE-2023-28434High· 8.8▾ Abyssal⚠ Exploited in the wildPoC availablePrivilege Escalation on Linux/MacOS
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 1.6 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Federal remediation due Oct 10, 2023
7.9%
Last analysed / modified upstream
1 GitHub repo (last check)
Added to the CISA catalog on Sep 19, 2023. Federal remediation due Oct 10, 2023. View catalog ↗
An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3:::* permission, as well as enabled Console API access.
commit 67f4ba154a27a1b06e48bfabda38355a010dfca5
Author: Aditya Manthramurthy <[email protected]>
Date: Sun Mar 19 21:15:20 2023 -0700
fix: post policy request security bypass (#16849)
Browser API access must be enabled turning off MINIO_BROWSER=off allows for this workaround.
The vulnerable code:
// minio/cmd/generic-handlers.go
func setRequestValidityHandler(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// ...
// For all other requests reject access to reserved buckets
bucketName, _ := request2BucketObjectName(r)
if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {
if !guessIsRPCReq(r) && !guessIsBrowserReq(r) && !guessIsHealthCheckReq(r) && !guessIsMetricsReq(r) && !isAdminReq(r) && !isKMSReq(r) {
if ok {
tc.FuncName = "handler.ValidRequest"
tc.ResponseRecorder.LogErrBody = true
}
writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL)
return
}
}
// ...
github.com/minio/minio < 0.0.0-202303200415Upgrade to a patched release:
github.com/minio/minio 0.0.0-202303200415Connected by shared product, vendor, weakness, or advisory.
CVE-2024-24747High· 8.8Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
CVE-2025-62506High· 8.1MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
CVE-2025-31489HighMinIO performs incomplete signature validation for unsigned-trailer uploads
CVE-2026-42600Medium· 4.9MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
CVE-2025-27414MediumMinIO allows an SFTP authentication bypass due to improperly trusted SSH key
CVE-2023-28433High· 8.8Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation