Product
AiStor Logo
Overview
What is AIStor?
Features
Replication Replication Versioning Versioning Observability Observability Encryption Encryption Key Management Server Key Management Server S3 Compatibility S3 Compatibility Object Immutability Object Immutability Catalog Catalog Object Prompt Object Prompt xxx Identity + Access Mgt Firewall Firewall AIHub AIHub Lifecycle Lifecycle Cache Cache Events and Lambdas Events and Lambdas Console Console
Tools
Erasure Code Calculator Erasure Code Calculator Determine your raw and usable capacity across a range of erasure coding settings. Reference Hardware Reference Hardware MinIO’s recommended Configuration and reference hardware for building large scale data infrastructure.
Solutions
AI Storage Learn how MinIO is leading the AI storage market from its exclusive features to performance at scale. HDFS Migration Modernize and simplify your big data storage infrastructure with cloud native storage with AIStor. Snowflake Learn how to leverage Snowflake external tables to query data without having to move it.
Integrations Integrations with MinIO Browse our expansive list of
integrations with links to the relevant
documentation.
Veeam Learn how MinIO and Veeam have partnered deliver superior RTO and RPO. Modern Datalakes Learn how modern, multi-engine data lakeshouses depend on MinIO's AIStor. Equinix Repatriate your data onto the cloud you control with MinIO and Equinix. SQL Server Learn how to leverage SQL Server 2022 with MinIO to run queries on your data without having to move it. Commvault Learn how Commvault and MinIO are partnered to deliver performance at scale for mission critical backup and restore workloads. Hybrid Cloud Learn how enterprises use MinIO to build AI data infrastructure that runs on any cloud - public, private or colo. Splunk Find out how MinIO is delivering performance at scale for Splunk SmartStores. VMware Discover how MinIO integrates with VMware across the portfolio from the Persistent Data platform to TKG and how we support their Kubernetes ambitions.
Open Source
Github Community Explore, experiment, ask questions and contribute. Docs Development guides. Slack Channel Open Forum for discussing topics related to MinIO.
Download MinIO Object Store Download MinIO Object Store Get MinIO's open source server, client, and SDK.
Resources
Resources Home Browse our library of white papers, solution briefs, benchmarks and videos. Blog Product updates, company news, and educational content. Training Learn the MinIO Way and Become a Data Infrastructure Expert.
Events Events Join us to take advantage to meet with MinIO partners, employees, and subject-matter experts.
Partner Pricing
Login Download

Understanding the Attack Vector for CVE-2023-28432 and CVE-2023-28434

Andreas Auernhammer Andreas Auernhammer on Security Advisory

On September 4th, it was uncovered that an unknown threat actor had attacked publicly available MinIO object storage clusters. The attackers exploited two known security vulnerabilities in the MinIO server: CVE-2023-28432 and CVE-2023-28434

Both vulnerabilities had been reported and fixed on March 19th and 20th, and a new release, RELEASE.2023-03-20T20-16-18Z, was published on the same day. Both CVEs were published one day later on March 21st.

Who is affected?

Any publicly reachable MinIO object storage cluster running version RELEASE.2023-03-13T19-46-17Z  or earlier is affected by both CVEs. All users are highly recommended to update to at least RELEASE.2023-03-20T20-16-18Z or the latest release.

Users who cannot update immediately should consider applying the following countermeasures:

Exploit chain and Impact

An attack on a vulnerable and publicly accessible MinIO cluster looks as following:

An incident response team at Security Joes has done an elaborate attack analysis which can be found here.

Notifications

All members of MinIO SUBNET received  notifications about security issues and upgrade recommendations.

Registering MinIO clusters on the SUBNET can be a proactive measure to prevent such attacks on critical infrastructure. In this particular instance, both vulnerabilities had been known for over five months, and updates had been readily available.

Summary

The stacking of these CVEs and the replacement of MinIO with an evil twin is a highly sophisticated attack trajectory and we strongly urge our customers and community to upgrade. If you are using an older Apache Licensed version of MinIO, these fixes are no longer backported from the GNU AGPLv3 licensed upstream. Third-party distributions of MinIO are particularly vulnerable to these attack vectors. We strongly encourage you to move to the most recent version - attackers will be looking for vulnerable MinIO clusters, especially the ones running the Apache licensed code. Please take this advisory seriously and keep your data safe.