{"id":"CVE-2023-28434","aliases":["EUVD-2023-2395","GHSA-2pxw-r47w-4p8c"],"status":"published","title":"MinIO is vulnerable to privilege escalation on Linux/MacOS","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.07917,"percentile":0.94769,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-269"],"published":"2023-03-22T20:44:04Z","modified":"2026-10-28T02:30:27Z","kev":{"date_added":"2023-09-19","due_date":"2023-10-10","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-09-19"},{"source":"kev","since":"2023-09-19"}],"exploits":[{"source":"pocgithub","id":"AbelChe/evil_minio","title":"AbelChe/evil_minio","date":"2023-03-27","url":"https://github.com/AbelChe/evil_minio"}],"fixes":[{"ecosystem":"Go","package":"github.com/minio/minio","fixed_in":["0.0.0-202303200415"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/minio/minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-202303200415"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/minio/minio","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-202303200415"}]}]}],"products":[{"vendor":"minio","product":"minio"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/minio/minio/pull/16849","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","fix","web"]},{"url":"https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28434","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2pxw-r47w-4p8c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28434.json","tags":["advisory"]},{"url":"https://github.com/minio/minio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28434","title":"MinIO is vulnerable to privilege escalation on Linux/MacOS","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","status":"published","published":"2023-03-22T20:44:04.216Z","modified":"2025-10-21T23:15:22.302Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-2395","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","status":"published","published":"2023-03-22T20:44:04Z","modified":"2025-10-21T23:15:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2023-09-19","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-2pxw-r47w-4p8c","title":"Privilege Escalation on Linux/MacOS","description":"### Impact\nAn attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.\n\n### Patches\n```\ncommit 67f4ba154a27a1b06e48bfabda38355a010dfca5\nAuthor: Aditya Manthramurthy \u003cdonatello@users.noreply.github.com\u003e\nDate:   Sun Mar 19 21:15:20 2023 -0700\n\n    fix: post policy request security bypass (#16849)\n```\n\n### Workarounds\nBrowser API access must be enabled turning off `MINIO_BROWSER=off` allows for this workaround.\n\n### References\nThe vulnerable code:\n```go\n// minio/cmd/generic-handlers.go\nfunc setRequestValidityHandler(h http.Handler) http.Handler {\n  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n    // ...\n    // For all other requests reject access to reserved buckets\n    bucketName, _ := request2BucketObjectName(r)\n    if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {\n      if !guessIsRPCReq(r) \u0026\u0026 !guessIsBrowserReq(r) \u0026\u0026 !guessIsHealthCheckReq(r) \u0026\u0026 !guessIsMetricsReq(r) \u0026\u0026 !isAdminReq(r) \u0026\u0026 !isKMSReq(r) {\n        if ok {\n          tc.FuncName = \"handler.ValidRequest\"\n          tc.ResponseRecorder.LogErrBody = true\n        }\n        writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL)\n        return\n      }\n    }\n    // ...\n```","status":"published","published":"2023-09-05T15:45:10Z","modified":"2025-10-22T19:20:03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2023-28434","title":"MinIO Security Feature Bypass Vulnerability","description":"MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.","cwes":["CWE-269"],"kev":{"date_added":"2023-09-19","due_date":"2023-10-10","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-28434","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","status":"published","published":"2023-03-22T21:15:18.427Z","modified":"2026-06-17T05:47:43.61Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"CVE-2023-28434","title":"MinIO is vulnerable to privilege escalation on Linux/MacOS","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","status":"published","published":"2023-03-22T20:44:04.216Z","modified":"2026-10-28T02:30:27.094396574Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-2pxw-r47w-4p8c","title":"Privilege Escalation on Linux/MacOS","description":"### Impact\nAn attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.\n\n### Patches\n```\ncommit 67f4ba154a27a1b06e48bfabda38355a010dfca5\nAuthor: Aditya Manthramurthy \u003cdonatello@users.noreply.github.com\u003e\nDate:   Sun Mar 19 21:15:20 2023 -0700\n\n    fix: post policy request security bypass (#16849)\n```\n\n### Workarounds\nBrowser API access must be enabled turning off `MINIO_BROWSER=off` allows for this workaround.\n\n### References\nThe vulnerable code:\n```go\n// minio/cmd/generic-handlers.go\nfunc setRequestValidityHandler(h http.Handler) http.Handler {\n  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n    // ...\n    // For all other requests reject access to reserved buckets\n    bucketName, _ := request2BucketObjectName(r)\n    if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {\n      if !guessIsRPCReq(r) \u0026\u0026 !guessIsBrowserReq(r) \u0026\u0026 !guessIsHealthCheckReq(r) \u0026\u0026 !guessIsMetricsReq(r) \u0026\u0026 !isAdminReq(r) \u0026\u0026 !isKMSReq(r) {\n        if ok {\n          tc.FuncName = \"handler.ValidRequest\"\n          tc.ResponseRecorder.LogErrBody = true\n        }\n        writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL)\n        return\n      }\n    }\n    // ...\n```","status":"published","published":"2023-09-05T15:45:10Z","modified":"2026-10-08T08:11:01.963531191Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}