CVE-2023-28432

MinIO, a Multi-Cloud Object Storage framework, exposes its entire set of environment variables in distributed (cluster) deployments running RELEASE.2019-12-17T23-16-33Z or later but prior to RELEASE.2023-03-20T20-16-18Z: an unauthenticated POST request to the cluster bootstrap endpoint (/cluster?bootstrap) on the MinIO API port (default 9000) returns secrets including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker with network access to that port needs no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N, 7.5 high), and with the retrieved root credentials gains full administrative control over the stored objects; the publicly shared 'Evil_MinIO' exploit demonstrates the disclosure can be chained into full server compromise. Only distributed/cluster deployments are affected; the flaw is classified as CWE-200 information disclosure. The bug is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-21, EPSS ranks it in the 100th percentile with an 84% probability of exploitation within 30 days, and attacks on MinIO servers using the Evil_MinIO exploit have been reported.

What to do: Upgrade distributed MinIO clusters to RELEASE.2023-03-20T20-16-18Z or later per the vendor advisory and the CISA KEV required action, and restrict untrusted network access to the MinIO API port (default 9000). Because the flaw leaks the entire environment, rotate MINIO_ROOT_PASSWORD/MINIO_SECRET_KEY and any other credentials passed via environment variables, and review logs for suspicious POST /cluster?bootstrap requests or unexpected logins.