^{CVE-2023-28432:}Information disclosure vulnerability in MinIO cluster deployments allows access to sensitive environment variables including secret keys and root passwords.

Overview

MinIO is a popular high-performance, S3-compatible object storage solution used by many organizations for cloud-native applications. The vulnerability affects all distributed deployments of MinIO from December 2019 through March 2023. When exploited, attackers can access environment variables containing sensitive authentication credentials, potentially leading to complete compromise of the MinIO deployment and all data stored within. This vulnerability has been actively exploited in the wild, as documented by security researchers at GreyNoise, who observed scanning attempts targeting this vulnerability across the internet.

Remediation

All users running MinIO in distributed deployment mode should immediately upgrade to RELEASE.2023-03-20T20-16-18Z or later. After upgrading, organizations should:

1. Rotate all MinIO access credentials, especially root credentials
2. Audit access logs for any unauthorized access attempts
3. Review security configurations to ensure proper network segmentation and access controls
4. Consider implementing additional authentication mechanisms such as identity federation where possible
5. Monitor for suspicious activities that might indicate compromise

For users who cannot immediately upgrade, limiting network access to the MinIO administrative endpoints can serve as a temporary mitigation, though this is not a complete solution.

References

1. Official MinIO security advisory: https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
2. Fixed release information: https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
3. GreyNoise analysis: https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
4. GreyNoise observation data: https://viz.greynoise.io/tag/minio-information-disclosure-attempt
5. Security researcher Andrew Morris's observations: https://twitter.com/Andrew___Morris/status/1639325397241278464