{"id":"CVE-2023-28434","kind":"vulnerability","aliases":["CVE-2023-28434"],"related":[],"title":"Minio is a Multi-Cloud Object Storage framework","description":"MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"MinIO, a self-hosted S3-compatible object store, has a flaw in PostPolicyBucket handling that lets a user write objects into any bucket. An attacker with credentials that already hold broad s3 permissions can escalate privileges and reach data they should not access.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-09-19T00:00:00+00:00","products":[{"name":"MinIO MinIO","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"minio","fixed":["2023-03-20t20-16-18z"],"affected":"< 2023-03-20t20-16-18z","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","minio","package","s3-compatible-storage","self-hosted"],"not_affected_if":["managed-hosting","no-console-api","no-wildcard-s3-credentials"],"how_to_check":"Check whether the Console API is enabled on your MinIO deployment (look for the console listener or MINIO_BROWSER settings).\nList IAM users and policies and look for any with arn:aws:s3:::* permissions.","fix":"Upgrade MinIO to a release that includes the fix for CVE-2023-28434 (the fixed version is not stated in the sources).\nUntil patched, disable Console API access and restrict credentials that hold arn:aws:s3:::* permissions.","status":"open","published_at":"2023-03-22T21:15:18+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:04:36Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade MinIO to a release that includes the fix for CVE-2023-28434 (the fixed version is not stated in the sources).\nUntil patched, disable Console API access and restrict credentials that hold arn:aws:s3:::* permissions.","reach":"network","impact":"medium","summary":"MinIO, a self-hosted S3-compatible object store, has a flaw in PostPolicyBucket handling that lets a user write objects into any bucket. An attacker with credentials that already hold broad s3 permissions can escalate privileges and reach data they should not access.","category":"package","who_cares":["minio","self-hosted","s3-compatible-storage"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker writes objects into any bucket, escalating privileges via PostPolicy uploads.","analyst_note":"Confirm the fixed MinIO release version and the exact Console API setting from the vendor advisory; sources give neither.","how_to_check":"Check whether the Console API is enabled on your MinIO deployment (look for the console listener or MINIO_BROWSER settings).\nList IAM users and policies and look for any with arn:aws:s3:::* permissions.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-console-api","no-wildcard-s3-credentials"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000536,"input_tokens":2880,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,14A '-28434':12A,15A 'access':73B,129C 'action':132C 'allow':82C 'alreadi':59B 'api':128C 'appli':133C 'arn':119C 'attack':55B,84C,113C,115C 'aw':120C 'broad':61B 'bucket':53B,92C,101C 'bypass':79C,90C 'carri':110C 'check':94C 'cisa':130C 'cloud':6A 'compat':24B,36B 'conduct':106C 'consol':127C 'contain':75C 'craft':87C 'credenti':57B,117C 'cve':10A,13A 'data':69B 'discontinu':139C 'enabl':126C 'escal':65B,108C 'exploit':19B 'featur':78C 'flaw':41B 'framework':9A 'handl':44B 'hold':60B 'host':28B,33B 'instruct':137C 'let':46B 'metadata':91C 'minio':1A,16A,17A,18A,20B,29B,74C 'mitig':134C,145C 'multi':5A 'multi-cloud':4A 'name':93C 'object':7A,37B,50B,98C 'packag':21B 'per':135C 'permiss':63B,122C 'postpolicybucket':43B,104C 'privileg':66B,107C 'process':103C 'product':143C 'put':96C 'reach':68B 'request':88C 'requir':116C,131C 's3':23B,35B,62B,121C 's3-compatible':34B 's3-compatible-storage':22B 'secur':77C 'self':27B,32B 'self-host':26B,31B 'storag':8A,25B 'store':38B 'unavail':147C 'use':86C,140C 'user':48B 'vendor':136C 'vulner':80C 'well':124C 'write':49B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-22T21:15:18+00:00","kev":{"dateAdded":"2023-09-19","dueDate":"2023-10-10","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-28434","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28434","severity":null,"published_at":"2023-09-19T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-28434","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28434","severity":null,"published_at":"2023-03-22T21:15:18+00:00","modified_at":"2026-06-17T05:47:43+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}