Sep 19, 2023

Started

• Closed✓Patched

  MinIO: Security Feature Bypass (CVE-2023-28434)

  MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. Added to CISA KEV on 2023-09-19.

  MinIO·Closed Sep 19, 2023·updated Sep 19, 2023