CVE-2023-28432

Minio Information Disclosure in Cluster Deployment

Basic Information

CVE State: PUBLISHED
Reserved Date: March 15, 2023
Published Date: March 22, 2023
Last Updated: January 28, 2025
Vendor: minio
Product: minio
Description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (added 2023-04-21 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2023-12-07 03:33:37 UTC) Source

References

https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z https://twitter.com/Andrew___Morris/status/1639325397241278464 https://viz.greynoise.io/tag/minio-information-disclosure-attempt https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean

Known Exploited Vulnerability Information

Source	Added Date
CISA	2023-04-21 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28432.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

C1ph3rX13/CVE-2023-28432

Type: github • Created: 2023-12-07 03:33:37 UTC • Stars: 1

CVE-2023-28432 Minio Information isclosure Exploit

yTxZx/CVE-2023-28432

Type: github • Created: 2023-10-20 10:20:10 UTC • Stars: 3

Chocapikk/CVE-2023-28432

Type: github • Created: 2023-09-05 14:01:53 UTC • Stars: 3

Automated vulnerability scanner for CVE-2023-28432 in Minio deployments, revealing sensitive environment variables.

Cuerz/CVE-2023-28432

Type: github • Created: 2023-03-29 01:26:30 UTC • Stars: 10

CVE-2023-28432 MinIO敏感信息泄露检测脚本

acheiii/CVE-2023-28432

Type: github • Created: 2023-03-24 08:27:32 UTC • Stars: 10

CVE-2023-28432 POC

MzzdToT/CVE-2023-28432

Type: github • Created: 2023-03-24 08:13:34 UTC • Stars: 34

MinIO敏感信息泄露漏洞批量扫描poc&exp

gobysec/CVE-2023-28432

Type: github • Created: 2023-03-23 16:27:47 UTC • Stars: 10

MiniO verify interface sensitive information disclosure vulnerability (CVE-2023-28432)

Mr-xn/CVE-2023-28432

Type: github • Created: 2023-03-23 14:44:24 UTC • Stars: 33

CVE-2023-28434 nuclei templates