CVE-2023-28434
MinIO Security Feature Bypass Vulnerability
Description
CVE-2023-28434 is an improper privilege management vulnerability in MinIO, the popular multi-cloud object storage framework, that allows an authenticated attacker to bypass metadata bucket name checking and write objects into arbitrary buckets via crafted PostPolicyBucket requests. Exploitation requires credentials with wildcard S3 permissions (arn:aws:s3:::*) and enabled Console API access. The vulnerability was patched in MinIO RELEASE.2023-03-20T20-16-18Z. CISA has added CVE-2023-28434 to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 10, 2023. With a CVSS score of 8.8 (High) and a notably high EPSS score of 39.03% (97.18th percentile), this MinIO security vulnerability represents an urgent threat to organizations using unpatched MinIO deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| minio | minio | < 2023-03-20t20-16-18z |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5(Patch)
- https://github.com/minio/minio/pull/16849(Exploit, Issue Tracking)
- https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly assign, modify, track, or check privileges for actors, creating an unintended access sphere. In CVE-2023-28434, this manifests as a failure in MinIO's PostPolicyBucket handling to properly enforce bucket-level access controls, allowing an attacker with wildcard S3 permissions to bypass bucket name metadata checks and write objects into any bucket regardless of intended access restrictions.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2023-28434 carries a CVSS v3.1 score of 8.8 (High severity), reflecting a serious privilege escalation and data integrity risk in MinIO object storage. Attack Vector (Network): The vulnerability is remotely exploitable through MinIO's network-accessible API, requiring no physical access to the storage infrastructure. Attack Complexity (Low): Exploitation is straightforward once the attacker has the required credentials and Console API access. Privileges Required (Low): While the attacker needs valid credentials with wildcard S3 permissions, this is classified as low privilege since such broad permissions are commonly assigned in many MinIO deployments. User Interaction (None): No action from administrators or other users is required for the exploit to succeed. Confidentiality, Integrity, and Availability (all High): A successful attack allows writing objects into arbitrary buckets, which can lead to data tampering, unauthorized data access by overwriting access policies, and potential denial of service by filling storage capacity or corrupting critical objects. The EPSS score of 39.03% (97.18th percentile) signals a very high likelihood of active exploitation, and the availability of a public exploit through the MinIO GitHub pull request further elevates the real-world risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-28434 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of October 10, 2023. Public exploit code is available for CVE-2023-28434 via the MinIO GitHub pull request #16849, which is tagged as both an exploit and issue tracking reference. The EPSS score of 39.03% (97.18th percentile) indicates a very high probability of exploitation activity, placing this vulnerability among the most likely to be exploited in the current threat landscape. The combination of publicly available exploit details, confirmed active exploitation, and the high EPSS score makes CVE-2023-28434 an immediate priority for remediation.
Remediation
- Upgrade MinIO immediately. Update MinIO to RELEASE.2023-03-20T20-16-18Z or later, which contains the fix for the PostPolicyBucket bypass. The patch commit is available at 67f4ba1. CISA's KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Apply the interim workaround if patching is delayed. As documented in the MinIO security advisory, disable browser API access by setting the environment variable \ to prevent exploitation through the Console API while preparing for the full upgrade.
- Review and restrict S3 permissions. Audit all MinIO user and service account policies to eliminate unnecessary wildcard permissions (arn:aws:s3:::*). Apply the principle of least privilege by granting bucket-specific permissions instead of blanket access across all buckets.
- Audit bucket contents for unauthorized objects. Review all MinIO buckets for unexpected or unauthorized objects that may have been written via the PostPolicyBucket bypass. Check object metadata, creation timestamps, and access logs to identify any exploitation activity prior to patching.
- Implement network-level access controls. Restrict access to the MinIO Console API to trusted administrative networks only. Deploy network segmentation and firewall rules to limit which systems can reach MinIO management endpoints, reducing the attack surface for credential-based attacks.
Technical Details
CVE-2023-28434 is classified under CWE-269 (Improper Privilege Management), where MinIO's PostPolicyBucket request handler fails to properly enforce bucket name validation in metadata checks, allowing an authenticated attacker to bypass intended access controls and write objects into arbitrary buckets. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) in the form of valid credentials with wildcard S3 permissions (arn:aws:s3:::*) and enabled Console API access. No user interaction is needed (UI:N), and the scope remains unchanged (S:U). All three impact metrics are rated High (C:H/I:H/A:H), as the ability to write arbitrary objects into any bucket can compromise data confidentiality through policy manipulation, data integrity through object tampering, and availability through storage exhaustion. The root cause lies in insufficient metadata validation during the PostPolicyBucket processing flow, where crafted requests can specify a target bucket that differs from the policy-intended bucket, effectively circumventing the bucket-level access control enforcement.
Frequently Asked Questions
Is CVE-2023-28434 being actively exploited?
Yes. CISA has added CVE-2023-28434 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of October 10, 2023. Public exploit code is available through the MinIO GitHub pull request. The EPSS score of 39.03% places this in the 97.18th percentile, indicating very high exploitation activity.
What products are affected by CVE-2023-28434?
CVE-2023-28434 affects MinIO object storage releases prior to RELEASE.2023-03-20T20-16-18Z. The vulnerability is in the PostPolicyBucket handling and impacts any MinIO deployment where Console API access is enabled and users have wildcard S3 permissions.
How do I fix CVE-2023-28434?
Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later. As an interim workaround, set MINIO_BROWSER=off to disable Console API access. Additionally, audit and restrict wildcard S3 permissions across all MinIO users and service accounts. See the Remediation section for detailed steps.
How severe is CVE-2023-28434?
CVE-2023-28434 is rated High severity with a CVSS v3.1 score of 8.8 out of 10. The EPSS score of 39.03% places it in the 97.18th percentile, indicating a very high probability of exploitation. The combination of public exploit availability and confirmed active exploitation makes this a critical priority for MinIO administrators.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.