CVE-2023-28434 KEVPublic exploit High · 8.8 EPSS 7.9%

MinIO Security Feature Bypass Vulnerability

MinIO · MinIO

Summary

MinIO, the multi-cloud object storage framework, contains a security feature bypass in its PostPolicyBucket handling, where metadata bucket name checks can be circumvented via crafted requests. An attacker holding credentials with arn:aws:s3:::* permission and with Console API access enabled can use this flaw to place an object into any bucket, network-reachable and without user interaction.

Official description · NVD

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Breakdown

68.1 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 5/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Log in with real accountsT1078 · Valid AccountsAI-written (claude-haiku-5-5)Medium confidence56 general detection rules
What they do
- Tamper with dataT1565 · Data ManipulationAI-written (claude-haiku-5-5)Medium confidence3 general detection rules

First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 days after disclosure.

Disclosed22 Mar 2023day 0
Public exploit codePoC-in-GitHub27 Mar 2023+5 days
First seen exploitedVulnCheck KEV evidence4 Sep 2023+5 mo
Added to CISA KEVEU database agrees19 Sep 2023+6 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

2 related vulnerabilities in the same code over 10 months. The latest fix listed for github.com/minio/minio is 0.0.0-20240527191746-e0fe7cc39172.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2023-28434MinIO Security Feature Bypass22 Mar 2023KEV
relatedMedium
Why these are linked:
- Same code patched: auth-handler.go (machine-matched)commit 67f4ba1 commit 0ae4915
CVE-2024-24747MinIO unsafe default: Access keys inherit `admin` of root user…31 Jan 2024

Fixes in github.com/minio/minioGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

0.0.0-202303200415CVE-2023-2843422 Mar 2023KEV
0.0.0-202303200735CVE-2023-2843322 Mar 2023
0.0.0-20240131185645-0ae4915a9391CVE-2024-2474731 Jan 2024
0.0.0-20240527191746-e0fe7cc39172CVE-2024-3610728 May 2024Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Valid Accounts T1078 Medium also Persistence, Privilege Escalation, Stealth

AI mapping from the description · how it is exploited

Requires valid credentials with broad S3 permissions

the attacker requires credentials with `arn:aws:s3:::*` permission

From the official description (NVD) Original ↗

ImpactTA0040

Data Manipulation T1565 Medium

AI mapping from the description · primary impact

Unauthorized object writes into arbitrary buckets

put an object into any bucket while processing `PostPolicyBucket`

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 59 general rules for its techniques

Rules for this CVE

0 that reference CVE-2023-28434 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Valid AccountsT107856 general rules

Win Susp Computer Name Containing Samtheadmincriticaltest
Account Created And Deleted Within A Close Time Framehightest
Activity From Anonymous IP Addresshightest
Atypical Travelhightest
Azure AD Threat Intelligencehightest
Azure Subscription Permission Elevation Via AuditLogshightest
External Remote SMB Logon from Public IPhightest
Impossible Travelhightest

All 56 on SigmaHQ ↗

Data ManipulationT15653 general rules

Powershell Add Name Resolution Policy Table Rulehightest
AWS EC2 Disable EBS Encryptionmediumstable
Google Cloud Re-identifies Sensitive Informationmediumtest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/minio/minio.

Gogithub.com/minio/minioGHSA-2pxw-r47w-4p8c

Upgrade to 0.0.0-202303200415 or later

Gogo get github.com/minio/minio@v0.0.0-202303200415

The first fix for CVE-2023-28434. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you run	Upgrade to
All versions before 0.0.0-202303200415	0.0.0-202303200415

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 19 Sep 2023. Federal due date 10 Oct 2023. No recorded ransomware use.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 19 Sep 2023. EUVD-2023-2395

Public exploitAdvisories link exploit code.

, 30 Oct 2026

7.9%Top 5.3%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 94.7%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1153 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9472 18.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total68.1

Record

Published: 22 Mar 2023
Modified: 17 Jun 2026
: CWE-269 Improper Privilege Management
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in github.com/minio/minioGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 1

US Government Resource 1

Exploit 1

How attackers get in

What they do

techniques