CVE-2023-28432— Minio Information Disclosure in Cluster Deployment
Quick assessment
Affected
minio minio
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO 存在信息泄露漏洞，该漏洞源于在集群部署中MinIO会返回所有环境变量，导致信息泄露。
Public Exploits 2
Metasploit · 1
minio_bootstrap_verify_info_disc.rb [auxiliary]
Nuclei · 1
CVE-2023-28432.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28432
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Minio Information Disclosure in Cluster Deployment
Source: CVE Program / CVE List V5
Vulnerability Description
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
MinIO 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO 存在信息泄露漏洞，该漏洞源于在集群部署中MinIO会返回所有环境变量，导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2023-28432
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2023-28434 nuclei templates | https://github.com/Mr-xn/CVE-2023-28432 | POC Details |
| 2 | MiniO verify interface sensitive information disclosure vulnerability (CVE-2023-28432) | https://github.com/gobysec/CVE-2023-28432 | POC Details |
| 3 | CVE-2023-28432,minio未授权访问检测工具 | https://github.com/Okaytc/minio_unauth_check | POC Details |
| 4 | MinIO敏感信息泄露漏洞批量扫描poc&exp | https://github.com/MzzdToT/CVE-2023-28432 | POC Details |
| 5 | CVE-2023-28432 POC | https://github.com/acheiii/CVE-2023-28432 | POC Details |
| 6 | 通过vulhub的复现过程实现了，基本的批量检测。比较垃圾但是勉强能用 | https://github.com/steponeerror/Cve-2023-28432- | POC Details |
| 7 | CVE-2023-28432 MinIO敏感信息泄露检测脚本 | https://github.com/Cuerz/CVE-2023-28432 | POC Details |
| 8 | minio敏感信息泄露 | https://github.com/Majus527/MinIO_CVE-2023-28432 | POC Details |
| 9 | None | https://github.com/LHXHL/Minio-CVE-2023-28432 | POC Details |
| 10 | Test environments for CVE-2023-28432, information disclosure in MinIO clusters | https://github.com/h0ng10/CVE-2023-28432_docker | POC Details |
| 11 | None | https://github.com/CHINA-china/MinIO_CVE-2023-28432_EXP | POC Details |
| 12 | MinIO Information Disclosure Vulnerability scanner by metasploit | https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner | POC Details |
| 13 | CVE-2023-28432检测工具 | https://github.com/bingtangbanli/CVE-2023-28432 | POC Details |
| 14 | Automated vulnerability scanner for CVE-2023-28432 in Minio deployments, revealing sensitive environment variables. | https://github.com/Chocapikk/CVE-2023-28432 | POC Details |
| 15 | None | https://github.com/yTxZx/CVE-2023-28432 | POC Details |
| 16 | https://github.com/AbelChe/evil_minio/tree/main 打包留存 | https://github.com/Fw-fW-fw/CVE-2023-28432-minio_update_rce | POC Details |
| 17 | https://github.com/AbelChe/evil_minio/tree/main 打包留存 | https://github.com/unam4/CVE-2023-28432-minio_update_rce | POC Details |
| 18 | CVE-2023-28432 Minio Information isclosure Exploit | https://github.com/C1ph3rX13/CVE-2023-28432 | POC Details |
| 19 | None | https://github.com/netuseradministrator/CVE-2023-28432 | POC Details |
| 20 | minio系统存在信息泄露漏洞，未经身份认证的远程攻击，通过发送特殊POST请求到/minio/bootstrap/v1/verify即可获取所有敏感信息，其中包括MINIO_SECRET_KEY和MINIO_ROOT_PASSWORD，可能导致管理员账号密码泄露。 | https://github.com/xk-mt/CVE-2023-28432 | POC Details |
| 21 | MinIO vulnerability exploit - CVE-2023-28432 | https://github.com/0xRulez/CVE-2023-28432 | POC Details |
| 22 | PoC for CVE-2023-28432 | https://github.com/fhAnso/CVE-2023-28432 | POC Details |
| 23 | MinIO vulnerability exploit - CVE-2023-28432 | https://github.com/BitWiz4rd/CVE-2023-28432 | POC Details |
| 24 | CVE-2023-28432检测工具 | https://github.com/NET-Flowers/CVE-2023-28432 | POC Details |
| 25 | MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28432.yaml | POC Details |
| 26 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/MinIO%20%E9%9B%86%E7%BE%A4%E6%A8%A1%E5%BC%8F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%20CVE-2023-28432.md | POC Details |
| 27 | https://github.com/vulhub/vulhub/blob/master/minio/CVE-2023-28432/README.md | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28432
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-28432 (1)
-
https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q x_refsource_CONFIRM
Security Blog Posts for CVE-2023-28432 (1)
Other References for CVE-2023-28432 (3)
Same Patch Batch · minio · 2023-03-22 · 3 CVEs total
| CVE-2023-28433 | 8.8 HIGH | Minio Privilege Escalation on Windows via Path separator manipulation |
| CVE-2023-28434 | 8.8 HIGH | MinIO is vulnerable to privilege escalation on Linux/MacOS |
IV. Related Vulnerabilities
Same product: minio
-
CVE-2026-97731
MinIO<7aac2a2越权复制漏洞 -
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Sto -
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String C -
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signat -
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 S
Same vendor: minio
-
CVE-2026-97731
MinIO<7aac2a2越权复制漏洞 -
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Sto -
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String C -
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signat -
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 S
Same weakness: CWE-200
-
CVE-2026-91157
Discourse: Media uploads remain publicly accessible after ca -
CVE-2026-77572
VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exp -
CVE-2026-73135
Gitea hidden-owner repository listing disclosure -
CVE-2026-66853
Gitea restricted-user organization metadata disclosure -
CVE-2026-14851
Unauthorised disclosure of information on Copart’s online bi
V. Comments for CVE-2023-28432
No comments yet