CVE-2023-28434

What it actually does

The flaw is an authorization bypass in MinIO object storage before RELEASE.2023-03-20T20-16-18Z. During PostPolicyBucket processing, crafted requests can bypass metadata bucket-name validation and allow an authenticated attacker to place objects into buckets they should not be able to target. Exploitation requires valid credentials with broad S3 permissions such as arn:aws:s3:::* and Console API access enabled. Successful exploitation can affect confidentiality, integrity, and availability because an attacker may write unauthorized objects, overwrite expected content if permissions and object naming allow it, stage malicious data, or disrupt applications that trust bucket contents.

Why it matters to the business

Organizations using affected MinIO releases may have exposed object-storage buckets to unauthorized writes by users or compromised credentials that were intended to have more limited access. This can lead to data tampering, malicious file placement, application disruption, compliance issues, and loss of trust in stored artifacts or backups. The vulnerability is listed in CISA KEV with active exploitation in the wild and had a federal remediation due date of 2023-10-10, so any remaining exposure should be treated as urgent even though it was published in 2023.

How an attack unfolds

An attacker first obtains or compromises MinIO credentials that include broad S3-style permissions, especially wildcard bucket access. They then confirm that the target MinIO deployment exposes Console API functionality and is running a vulnerable release. Using crafted PostPolicyBucket requests, the attacker manipulates bucket metadata handling so the server accepts an object write into a bucket that should not pass the normal bucket-name authorization checks. After gaining write capability, the attacker may upload unauthorized files, replace application-consumed objects, plant payloads for later retrieval, poison datasets or backups, or use the object store as a staging location for broader intrusion activity. Because exploitation is authenticated, investigations should focus heavily on suspicious use of legitimate access keys, service accounts, and Console/API activity rather than only unauthenticated scanning.

How to fix it

Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later. For source-based deployments, ensure the fix containing commit 05444a0f6af8389b9bb85280fc31337c556d4300 is present. Replace or rebuild container images, Helm charts, packages, and appliance bundles that embed older MinIO builds. As compensating controls, remove broad wildcard S3 permissions where possible, restrict Console API exposure to trusted networks, rotate credentials that had arn:aws:s3:::* or similar broad access, and review policies to enforce least privilege at bucket and object-prefix level. If immediate upgrade is not possible, follow vendor workaround guidance for browser/Console API configuration and reduce network/API access until patched.

How to confirm the fix worked

Confirm the running MinIO version reports RELEASE.2023-03-20T20-16-18Z or newer across every node in each cluster, including standby, development, backup, and embedded deployments. Verify that container image digests or package builds correspond to a patched release and are not merely retagged older images. Review IAM-style policies and remove unnecessary arn:aws:s3:::* permissions. In an authorized test environment, attempt to reproduce the unauthorized PostPolicyBucket cross-bucket write using a controlled low-privilege account and confirm the patched service rejects it. Validate that audit logging is enabled and records S3 API calls, access keys, bucket names, object keys, request sources, and response status codes.

Typical attack path

1. Identify an exposed MinIO service and determine whether Console API access is available.
2. Obtain valid MinIO/S3 credentials through phishing, credential leakage, CI/CD secret exposure, token theft, or prior compromise.
3. Verify that the credentials have broad S3 permissions such as arn:aws:s3:::* or equivalent wildcard bucket access.
4. Send crafted PostPolicyBucket requests that abuse improper metadata bucket-name validation.
5. Write objects into buckets outside the intended authorization boundary.
6. Use the unauthorized write to tamper with data, stage tools, poison application inputs, or disrupt services that rely on bucket contents.

How to detect it

Investigate MinIO audit logs, server logs, reverse-proxy or load-balancer logs, identity-provider logs, object event notifications, and endpoint/container telemetry for the period when vulnerable versions were exposed. Focus on authenticated Console/API activity from accounts or access keys with wildcard S3 permissions, especially PostPolicyBucket calls, unusual POST-based object uploads, object creation in sensitive buckets by identities that do not normally write there, and requests from unfamiliar IP addresses, autonomous systems, VPNs, cloud hosts, or geographies. Correlate object creation timestamps with authentication events and access-key usage. Review buckets for unexpected objects, modified application artifacts, web content, model/data files, backups, archives, or scripts added by broad-privilege identities. Because exploitation requires credentials, also investigate how the credentials may have been obtained, including leaked secrets in repositories, CI/CD logs, developer machines, container environment variables, and prior compromise. If object versioning is enabled, compare new or overwritten object versions around suspicious request times and preserve affected object versions for forensics.

• PostPolicyBucket
• api.name=PostPolicyBucket
• "apiName":"PostPolicyBucket"
• "api":"PostPolicyBucket"
• API: PostPolicyBucket
• POST /api/v1/buckets/
• X-Amz-Algorithm=AWS4-HMAC-SHA256
• arn:aws:s3:::*
• MINIO_BROWSER=off
• RELEASE.2023-03-20T20-16-18Z
• 05444a0f6af8389b9bb85280fc31337c556d4300

What your security team should do

• Immediately inventory all MinIO deployments and prioritize any internet-facing or partner-facing instances running releases before RELEASE.2023-03-20T20-16-18Z.
• Upgrade all affected deployments to RELEASE.2023-03-20T20-16-18Z or later and confirm the fixed commit 05444a0f6af8389b9bb85280fc31337c556d4300 is included where source builds are used.
• Treat this as a known-exploited vulnerability: perform retrospective log review for suspicious PostPolicyBucket activity, unexpected object creation, and use of broad-privilege credentials.
• Rotate MinIO access keys, service-account keys, and application secrets that had wildcard S3 permissions or were active during the exposure window.
• Restrict Console API and administrative/API endpoints to trusted networks, VPNs, private connectivity, or authenticated reverse proxies.
• Reduce authorization blast radius by replacing arn:aws:s3:::* style policies with least-privilege bucket and prefix-specific permissions.
• Enable and centralize MinIO audit logs, reverse-proxy logs, object event notifications, and identity-provider authentication logs for correlation.
• Create detection rules for authenticated object writes into unusual buckets, writes from new source IPs, high-volume PostPolicyBucket activity, and object creation by identities that do not normally write to those buckets.