CVE-2023-28432 PoC — MinIO 信息泄露漏洞

Source

https://github.com/h0ng10/CVE-2023-28432_docker

Associated Vulnerability

Title:MinIO 信息泄露漏洞 (CVE-2023-28432)
Description:MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO 存在信息泄露漏洞，该漏洞源于在集群部署中MinIO会返回所有环境变量，导致信息泄露。

Description

Test environments for CVE-2023-28432, information disclosure in MinIO clusters

Readme

# CVE-2023-28432_docker
Test environments for CVE-2023-28432, information disclosure in MinIO clusters.

The directories provide different versions / configurations for a MinIO cluster:

| Directory                  | Remark                                                                            |
| -------------------------- | --------------------------------------------------------------------------------- |
| leaked-key                 | Vulnerable instance, using the (deprecated) MINIO_ACCESS_KEY environment variable |
| leaked-password            | Vulnerable instance, using the MINIO_ROOT_PASSWORD environment variable.          |
| no-password                | Vulnerable instance, using the default credentials if no password is set          |
| not-vulnerable             | Secure instance                                                                   |
| not-vulnerable-default-pw  | Secure instance, using the default credentials, thus vulnerable                   |

File Snapshot


 [4.0K]  /data/pocs/5ed5e6c1752cf2e49c09b4349625d8c5a2752b8c
├── [4.0K]  leaked-key
│   └── [2.2K]  docker-compose.yml
├── [4.0K]  leaked-password
│   └── [2.3K]  docker-compose.yml
├── [4.0K]  no-password
│   └── [1.9K]  docker-compose.yml
├── [4.0K]  not-vulnerable
│   └── [2.3K]  docker-compose.yml
├── [4.0K]  not-vulnerable-default-pw
│   └── [1.9K]  docker-compose.yml
└── [ 994]  README.md

5 directories, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!