CVE-2023-28434 MinIO Security Feature Bypass

What is CVE-2023-28434?

CVE-2023-28434 is a high-severity vulnerability in minio, published on 22 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Weakness: CWE-269

Which versions are affected by CVE-2023-28434?

2 open source packages ship an affected version, including github.com/minio/minio. It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2023-28434?

Upgrade github.com/minio/minio to 0.0.0-202303200415 or later. US federal agencies must fix it by 10 Oct 2023.

Is CVE-2023-28434 being exploited?

Yes. Attackers have exploited CVE-2023-28434 in the wild since at least 19 Sep 2023.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in minio

• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1
• CVE-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2pxw-r47w-4p8c, MINI-4h7r-f3w5-mrq6, MINI-f4gp-rm3q-w7ww.