CVE-2023-28434: MinIO Security Feature Bypass Allows Privilege Escalation
What It Is – MinIO (versions prior to the 2023‑09‑01 patch) contains a security‑feature bypass that lets an attacker craft a request to skip bucket‑name validation in the PostPolicyBucket API. With valid credentials that include the arn:aws:s3:::* permission and console API access, the attacker can write objects to any bucket, effectively escalating privileges.
Exploitability – No public exploit code has been released, but the vulnerability is exploitable with a single crafted API call. The NVD assigns a CVSS 3.1 base score of 8.8 (High).
Affected Products – MinIO open‑source object storage server (all releases before the September 2023 security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that access‑control policies are enforced at runtime, not just at configuration time.
- Highlights the importance of immutable audit logs that capture every object‑write request for forensic traceability.
- Shows that a single mis‑enforced permission can undermine an entire storage trust boundary, a red flag for auditors demanding defensible evidence of least‑privilege enforcement.
Recommended Actions
- Apply the MinIO September 2023 security patch immediately.
- Review all IAM policies attached to MinIO service accounts; restrict
arn:aws:s3:::*permissions to the minimum required scope. - Disable unnecessary Console API access or enforce MFA for any privileged console sessions.
- Enable server‑side logging and forward logs to a SIEM for real‑time anomaly detection.
- Conduct a post‑patch validation test that attempts a
PostPolicyBucketwrite to an unauthorized bucket to confirm the fix.
Source: CISA KEV – CVE‑2023‑28434