CVE-2023-28432 PoC — Minio Information Disclosure in Cluster Deployment

Source

https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner

Associated Vulnerability

Title:Minio Information Disclosure in Cluster Deployment (CVE-2023-28432)
Description:Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Description

MinIO Information Disclosure Vulnerability scanner by metasploit

Readme

# CVE-2023-28432-metasploit-scanner
MinIO Information Disclosure Vulnerability scanner by metasploit

# preparation POC
```cmd
git clone https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner
cd CVE-2023-28432-metasploit-scanner
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp minio_information_disclosure.py ~/.msf4/modules/auxiliary/scanner/http/
chmod +x ~/.msf4/modules/auxiliary/scanner/http/minio_information_disclosure.py
msfconsole
```

# POC usage
```text
set rhosts <vuln ip/host>
set rport <vuln port>
set rssl <default: false for http>
exploit
```

# result
![poc](poc.png)

# reference
- https://github.com/Mr-xn/CVE-2023-28432
- https://github.com/MzzdToT/CVE-2023-28432

File Snapshot


 [4.0K]  /data/pocs/779d7265b6602a9381ef378d8ae22a6f2fc1f2fc
├── [3.1K]  minio_information_disclosure.py
├── [487K]  poc.png
└── [ 699]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!