Product
MinIO Enterprise Object Store
Overview Architecture
Features
MinIO for Public Cloud
AWS GCS Azure
MinIO for Private Cloud
OpenShift SUSE Rancher Tanzu
MinIO for Baremetal
Linux and Windows
Determine your raw and usable capacity Erasure Code Calculator MinIO's Recommended Hardware Configuration Reference Hardware
Solutions
AI Storage Object storage is powering the AI revolution. Learn how MinIO is leading the AI storage market through performance at scale. Modern Datalakes Modern, multi-engine datalakes depend on object stores that deliver performance at scale. Learn more about this core MinIO use case. Hybrid Cloud Effective multi-cloud storage strategies rely on utilizing architecture and tools that can function seamlessly across diverse environments. Equinix Repatriate your data onto the cloud you control with MinIO on Equinix to lower costs while maintaining public cloud adjacency. Splunk Find out how MinIO is delivering performance at scale for Splunk SmartStores. Snowflake Query and analyze multiple data sources, including streaming data, residing on MinIO with the Snowflake Data Cloud. No need to move the data, just query using SnowSQL. SQL Server Discover how to pair SQL Server 2022 with MinIO to run queries on your data on any cloud - without having to move it. HDFS Migration Modernize and simplify your big data storage infrastructure with high-performance, Kubernetes-native object storage from MinIO. VMware Discover how MinIO integrates with VMware across the portfolio from the Persistent Data platform to TKG and how we support their Kubernetes ambitions. Veeam Learn how MinIO and Veeam have partnered to drive performance and scalability for a variety of backup use cases. Commvault Learn how Commvault and MinIO are partnered to deliver performance at scale for mission critical backup and restore workloads. Integrations Browse our vast portfolio of integrations.
Community
GitHub Join our GitHub open source community: explore, experiment, ask questions, and contribute. Slack Channel The MinIO Community Slack provides an open forum for discussing topics related to MinIO. All support is provided on a best-effort basis.
Docs Blog Resources Training Partner Pricing Download

Understanding the Attack Vector for CVE-2023-28432 and CVE-2023-28434

Andreas Auernhammer Andreas Auernhammer on Security Advisory

On September 4th, it was uncovered that an unknown threat actor had attacked publicly available MinIO object storage clusters. The attackers exploited two known security vulnerabilities in the MinIO server: CVE-2023-28432 and CVE-2023-28434

Both vulnerabilities had been reported and fixed on March 19th and 20th, and a new release, RELEASE.2023-03-20T20-16-18Z, was published on the same day. Both CVEs were published one day later on March 21st.

Who is affected?

Any publicly reachable MinIO object storage cluster running version RELEASE.2023-03-13T19-46-17Z  or earlier is affected by both CVEs. All users are highly recommended to update to at least RELEASE.2023-03-20T20-16-18Z or the latest release.

Users who cannot update immediately should consider applying the following countermeasures:

Exploit chain and Impact

An attack on a vulnerable and publicly accessible MinIO cluster looks as following:

An incident response team at Security Joes has done an elaborate attack analysis which can be found here.

Notifications

All members of MinIO SUBNET received  notifications about security issues and upgrade recommendations.

Registering MinIO clusters on the SUBNET can be a proactive measure to prevent such attacks on critical infrastructure. In this particular instance, both vulnerabilities had been known for over five months, and updates had been readily available.

Summary

The stacking of these CVEs and the replacement of MinIO with an evil twin is a highly sophisticated attack trajectory and we strongly urge our customers and community to upgrade. If you are using an older Apache Licensed version of MinIO, these fixes are no longer backported from the GNU AGPLv3 licensed upstream. Third-party distributions of MinIO are particularly vulnerable to these attack vectors. We strongly encourage you to move to the most recent version - attackers will be looking for vulnerable MinIO clusters, especially the ones running the Apache licensed code. Please take this advisory seriously and keep your data safe.

Previous Post Next Post
S3 Select Security Modern Data Lakes Apache Presto SQL Performance S3 Brand/Design Golang Programming Cloud Computing Microservices Docker AWS Kubernetes Apache Spark Open Source Benchmarks Integrations SUBNET Edge Computing Sidekick Secure-by-Design Splunk Veeam Intel Apache Nifi Immutability Software Defined Storage VMware Apache Arrow Hybrid Cloud Red Hat OpenShift Multicloud Scalability Cloud Field Day Cloud Native Apache Kafka Architect's Guide Awards Operator's Guide Security Advisory AI/ML AGPLv3 Apache Hadoop SFD Azure GCP Observability Analytics R H20 DirectPV DevOps Apache Iceberg Apache Hudi YouTube Summaries EKS Elastic Load Balancers CI/CD Object Storage Compliance opentelemetry BC/DR Storage Newsletter Predictions Best Practices Dremio New MinIO Features partners Small Files Databases DuckDB PostgreSQL Delta Lake Cloud Repatriation Python Object Lambdas Data Pipelines Cloud Operating Model Webhook ClickHouse Vector Database Events Value Engineering Change Data Capture Enterprise Object Store GitOps Case Study Equinix