Hackers Exploit MinIO Storage System Vulnerabilities to Compromise Servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-28434 +1 in the same advisory: …28432 | Bucket Policy Bypass in MinIO Object Storage Lets Users Write to Any Bucket CVE-2023-28434 is a security feature bypass (CWE-269) in MinIO, an open-source multi-cloud object storage server, where metadata bucket name checking is not properly enforced while processing PostPolicyBucket requests. An attacker holding credentials granted the wildcard bucket permission arn:aws:s3:::* can send crafted requests to bypass the bucket name checks and put an object into any bucket, provided Console API access is enabled. The result is that bucket-level policy isolation can be violated, and in observed attacks the flaw (publicly dubbed Evil_MinIO) has been used against MinIO storage servers. All MinIO releases before RELEASE.2023-03-20T20-16-18Z are affected, with risk concentrated in deployments that expose the Console API and use wildcard-scope credentials. The vulnerability is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-19, public exploit code exists, and news reports describe ongoing attacks on MinIO servers. Do: Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, which contains the fix. If patching is delayed, apply the documented workaround involving the MINIO_BROWSER/browser API access setting as described in the advisory, and avoid granting credentials the wildcard arn:aws:s3:::* permission alongside Console API access. Since this is in CISA KEV (added 2023-09-19, required action: apply vendor mitigations or discontinue use) and the Evil_MinIO exploit has been used in real attacks, review exposed MinIO consoles for signs of compromise as part of remediation. | 8.8 group max | 8% | KEV PoC |
| largeon the order of tens of thousands of internet-exposed MinIO instances, plus uncounted private and embedded deployments |
Full article448 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 04, 2023Vulnerability / Server Security
An unknown threat actor has been observed weaponizing high-severity security flaws in the MinIO high-performance object storage system to achieve unauthorized code execution on affected servers.
Cybersecurity and incident response firm Security Joes said the intrusion leveraged a publicly available exploit chain to backdoor the MinIO instance.
The comprises CVE-2023-28432 (CVSS score: 7.5) and CVE-2023-28434 (CVSS score: 8.8), the former of which was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.
The two vulnerabilities "possess the potential to expose sensitive information present within the compromised installation and facilitate remote code execution (RCE) on the host where the MinIO application is operational," Security Joes said in a report shared with The Hacker News.
In the attack chain investigated by the company, the flaws are said to have been weaponized by the adversary to obtain admin credentials and abuse the foothold to replace the MinIO client on the host with a trojanized version by triggering an update command specifying a MIRROR_URL.
"The mc admin update command updates all MinIO servers in the deployment," the MinIO documentation reads. "The command also supports using a private mirror server for environments where the deployment does not have public internet access."
"The culmination of these actions permits the attacker to orchestrate a deceptive update," Security Joes said. "By replacing the authentic MinIO binary with its 'evil' counterpart, the attacker seals the compromise of the system."
The malicious modifications to the binary expose an endpoint that receives and executes commands via HTTP requests, effectively acting as a backdoor. The commands inherit the system permissions of the user who initiated the application.
It's worth noting that the altered version of the binary is a replica of an exploit named Evil MinIO that was published on GitHub in early April 2023. That said, there is no evidence to suggest a connection between the exploit’s author and the attackers.
What's evident is that the threat actor is proficient in working with bash scripts and Python, not to mention take advantage of the backdoor access to drop supplementary payloads from a remote server for post-exploitation via a downloader script.
The script, capable of targeting both Windows and Linux environments, functions as a gateway to profile the compromised hosts, based on which it's determined whether the execution must be terminated or not.
"This dynamic approach underscores the threat actor's strategic approach in optimizing their efforts based on the perceived value of the compromised system," Security Joes said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/hackers-exploit-minio-storage-system.html