MinIO 更新升级功能中存在远程命令执行

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.gksec.com/MinIO_RCE.html
• https://www.secrss.com/articles/58504
• https://cn-sec.com/archives/2305017.html
• https://y4er.com/posts/minio-cve-2023-28432/
• https://exp10it.io/posts/minio-cve-2023-28432-self-update-rce-analysis/
• https://thehackernews.com/2023/09/hackers-exploit-minio-storage-system.html
• https://www.bleepingcomputer.com/news/security/hackers-exploit-minio-storage-system-to-breach-corporate-networks/
• https://github.com/AbelChe/evil_minio
• https://cn-sec.com/archives/1869319.html

Related Vulnerabilities

• MinIO 权限管理不当漏洞 可导致权限提升
• PoCCVE-2021-21287: MinIO Browser API - Server-Side Request Forgery
• PoCCVE-2021-41266: MinIO Operator Console Authentication Bypass
• PoCCVE-2023-28432: MinIO Cluster Deployment - Information Disclosure
• PoCCVE-2023-2982: Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass
• PoCCVE-2025-31489: MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads
• PoCCVE-2023-28432: MinIO 未授权信息泄露
• PoCminio-default-password: Minio Default Password
• PoCminio-default-login: Minio - Default Login
• PoCminio-browser: MinIO Browser
• PoCminio-console: MinIO Console