CVE-2023-28432 MinIO Information Disclosure
Attackers can retrieve sensitive environment variables, including root credentials, from MinIO cluster deployments, leading to potential unauthorized access.
- Exploited in the wild
- Since 21 Apr 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28432?
CVE-2023-28432 is a high-severity vulnerability in minio, published on 22 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
Weakness: CWE-200
Which versions are affected by CVE-2023-28432?
It affects 1 product.
Products include Minio Minio.
How do I fix CVE-2023-28432?
No fix has been published for CVE-2023-28432 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 12 May 2023.
Is CVE-2023-28432 being exploited?
Yes. Attackers have exploited CVE-2023-28432 in the wild since at least 21 Apr 2023.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 20 proofs of concept on GitHub.
Other vulnerabilities in minio
- CVE-2023-28434 MinIO Security Feature Bypass
- CVE-2020-11012 Authentication bypass MinIO Admin API
- CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication
- CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
Sources
Also known as GHSA-6xvq-wj2x-3h3q.