CVE-2023-28434

CVE-2023-28434 is a security feature bypass (CWE-269) in MinIO, an open-source multi-cloud object storage server, where metadata bucket name checking is not properly enforced while processing PostPolicyBucket requests. An attacker holding credentials granted the wildcard bucket permission arn:aws:s3:::* can send crafted requests to bypass the bucket name checks and put an object into any bucket, provided Console API access is enabled. The result is that bucket-level policy isolation can be violated, and in observed attacks the flaw (publicly dubbed Evil_MinIO) has been used against MinIO storage servers. All MinIO releases before RELEASE.2023-03-20T20-16-18Z are affected, with risk concentrated in deployments that expose the Console API and use wildcard-scope credentials. The vulnerability is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-19, public exploit code exists, and news reports describe ongoing attacks on MinIO servers.

What to do: Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, which contains the fix. If patching is delayed, apply the documented workaround involving the MINIO_BROWSER/browser API access setting as described in the advisory, and avoid granting credentials the wildcard arn:aws:s3:::* permission alongside Console API access. Since this is in CISA KEV (added 2023-09-19, required action: apply vendor mitigations or discontinue use) and the Evil_MinIO exploit has been used in real attacks, review exposed MinIO consoles for signs of compromise as part of remediation.