On September 4th, it was uncovered that an unknown threat actor had attacked publicly available MinIO object storage clusters. The attackers exploited two known security vulnerabilities in the MinIO server: CVE-2023-28432 and CVE-2023-28434
Both vulnerabilities had been reported and fixed on March 19th and 20th, and a new release, RELEASE.2023-03-20T20-16-18Z, was published on the same day. Both CVEs were published one day later on March 21st.
Who is affected?
Any publicly reachable MinIO object storage cluster running version RELEASE.2023-03-13T19-46-17Z or earlier is affected by both CVEs. All users are highly recommended to update to at least RELEASE.2023-03-20T20-16-18Z or the latest release.
Users who cannot update immediately should consider applying the following countermeasures:
Exploit chain and Impact
An attack on a vulnerable and publicly accessible MinIO cluster looks as following:
An incident response team at Security Joes has done an elaborate attack analysis which can be found here.
All members of MinIO SUBNET received notifications about security issues and upgrade recommendations.
Registering MinIO clusters on the SUBNET can be a proactive measure to prevent such attacks on critical infrastructure. In this particular instance, both vulnerabilities had been known for over five months, and updates had been readily available.
The stacking of these CVEs and the replacement of MinIO with an evil twin is a highly sophisticated attack trajectory and we strongly urge our customers and community to upgrade. If you are using an older Apache Licensed version of MinIO, these fixes are no longer backported from the GNU AGPLv3 licensed upstream. Third-party distributions of MinIO are particularly vulnerable to these attack vectors. We strongly encourage you to move to the most recent version - attackers will be looking for vulnerable MinIO clusters, especially the ones running the Apache licensed code. Please take this advisory seriously and keep your data safe.