CVE-2023-28432
MinIO Information Disclosure Vulnerability
Description
CVE-2023-28432 is a high-severity information disclosure vulnerability in MinIO, a popular open-source multi-cloud object storage framework. In cluster deployments starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO exposes all environment variables — including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD — to unauthenticated remote attackers, resulting in complete credential compromise. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) and CISA has confirmed active exploitation in the wild. With an EPSS score of 93.9% (99.9th percentile), exploitation is near-certain, and public exploit details are available, making immediate upgrades critical for all MinIO distributed deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| minio | minio | >= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z(Release Notes)
- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q(Exploit, Vendor Advisory)
- https://twitter.com/Andrew___Morris/status/1639325397241278464(Third Party Advisory)
- https://viz.greynoise.io/tag/minio-information-disclosure-attempt(Third Party Advisory)
- https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2023-28432 is classified as an information disclosure vulnerability (CWE-200), where MinIO inadvertently exposes sensitive environment variables to unauthenticated users. The vulnerability occurs because MinIO's cluster deployment endpoints return all environment variables in their response without proper access controls or filtering, revealing secrets such as MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD that should never be accessible to external actors.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2023-28432 carries a CVSS 3.1 base score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Attack Vector (Network): the vulnerability is remotely exploitable over the network without requiring physical or adjacent access, meaning any internet-exposed MinIO cluster deployment is directly at risk. Attack Complexity (Low): exploitation is straightforward and requires no special conditions — a simple HTTP request to the vulnerable endpoint is sufficient to retrieve the sensitive environment variables. Privileges Required (None): no authentication is needed, making this accessible to any anonymous attacker who can reach the MinIO service. User Interaction (None): the attack proceeds entirely without victim action. Confidentiality (High): successful exploitation leaks all environment variables including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, which grant full administrative access to the MinIO deployment. An attacker who obtains these credentials can access, modify, or delete all objects stored in the MinIO cluster, effectively compromising the entire storage infrastructure. Integrity and Availability (None): while the vulnerability itself only discloses information, the leaked credentials enable subsequent attacks with full integrity and availability impact.
Exploit Maturity
Public exploit details are available for CVE-2023-28432 through the MinIO security advisory on GitHub, which provides detailed information about the vulnerable endpoint and exploitation methodology. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 12, 2023. The EPSS score of 93.9% (99.9th percentile) indicates near-certain exploitation activity. Active scanning for this vulnerability has been observed and documented by GreyNoise, confirming that attackers are actively probing internet-facing MinIO instances. While the ransomware usage status is listed as unknown, the ability to obtain full administrative credentials through a single unauthenticated HTTP request makes this vulnerability extremely attractive to attackers targeting cloud storage infrastructure.
Remediation
- Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later immediately: This release patches the environment variable disclosure vulnerability. Download the update from the official MinIO releases page.
- Rotate all secrets and credentials after upgrading: Because MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD may have already been exposed, rotate all MinIO access keys, secret keys, and root passwords immediately after applying the patch. Also rotate any other sensitive values that were stored as environment variables.
- Apply mitigations per CISA KEV guidance: Per the KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. The CISA remediation deadline was May 12, 2023.
- Restrict network access to MinIO management endpoints: Ensure that MinIO cluster management and health check endpoints are not exposed to the public internet. Use network firewalls, security groups, or reverse proxies to limit access to trusted internal networks only.
- Audit access logs for exploitation indicators: Review MinIO access logs and web server logs for requests to the vulnerable endpoint that may indicate prior exploitation. Check for unusual data access patterns that could suggest an attacker used leaked credentials to access stored objects.
- Adopt secret management best practices: Transition from environment variables to dedicated secret management solutions (such as HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets) to minimize the blast radius of future information disclosure vulnerabilities.
Technical Details
CVE-2023-28432 is an information disclosure vulnerability (CWE-200) in MinIO's cluster deployment mode. Root cause: MinIO's cluster health or configuration endpoint returns all process environment variables in its response body without any authentication check or filtering. This means that any environment variable set in the MinIO process context — including sensitive credentials like MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD — is accessible to any unauthenticated HTTP client that can reach the endpoint. Affected versions: all MinIO cluster deployments from RELEASE.2019-12-17T23-16-33Z through versions prior to RELEASE.2023-03-20T20-16-18Z are affected. Single-node (non-distributed) MinIO deployments are not impacted by this specific vulnerability. Attack mechanism: an unauthenticated attacker sends an HTTP request to the vulnerable MinIO endpoint. The server responds with a dump of all environment variables, including authentication credentials. The attacker then uses the leaked MINIO_ROOT_PASSWORD or MINIO_SECRET_KEY to authenticate as an administrator, gaining full read/write/delete access to all objects in the MinIO cluster. CVSS vector analysis: the network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N) make this trivially exploitable against any reachable MinIO cluster deployment. The confidentiality-only CVSS impact (C:H/I:N/A:N) reflects the direct vulnerability effect of information disclosure, but the practical impact extends to full cluster compromise once the attacker authenticates with the leaked credentials. The vulnerability was particularly notable because MinIO is commonly used as an S3-compatible storage backend in cloud-native environments, including deployments alongside platforms that handle sensitive data.
Frequently Asked Questions
Is CVE-2023-28432 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-28432 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 12, 2023. GreyNoise has documented active scanning for this vulnerability, and the EPSS score of 93.9% (99.9th percentile) indicates near-certain exploitation activity. The ransomware usage status is currently unknown.
What products are affected by CVE-2023-28432?
CVE-2023-28432 affects MinIO cluster (distributed) deployments from RELEASE.2019-12-17T23-16-33Z through versions prior to RELEASE.2023-03-20T20-16-18Z. Single-node MinIO deployments are not affected. All users of distributed MinIO deployments within this version range should upgrade immediately.
How do I fix CVE-2023-28432?
Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later to patch the environment variable disclosure. After upgrading, immediately rotate all credentials including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, as they may have already been compromised. See the Remediation section for additional hardening steps.
How severe is CVE-2023-28432?
CVE-2023-28432 is rated HIGH with a CVSS 3.1 base score of 7.5. While the CVSS impact is limited to confidentiality, the leaked credentials (MINIO_SECRET_KEY, MINIO_ROOT_PASSWORD) grant full administrative access to the entire MinIO cluster. The EPSS score of 93.9% (99.9th percentile) and confirmed active scanning make this a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.