CVE-2023-28434: MinIO Security Feature Bypass Vulnerability

CVE-2023-28434 is a security feature bypass in MinIO object storage that can allow privilege escalation. An attacker who already holds credentials with broad S3-style permissions and who can reach the Console API may send crafted requests that bypass bucket-name checks during PostPolicyBucket processing and place objects into arbitrary buckets. This matters because MinIO often holds sensitive data and is used as shared infrastructure; successful abuse expands an attacker’s write access beyond intended boundaries. Exact affected releases and patch identifiers must be confirmed against the vendor advisory.

How it works

The underlying weakness is improper privilege management (CWE-269). MinIO’s PostPolicyBucket path is intended to enforce metadata checks that restrict which bucket an object may be written into. The flaw lets an attacker craft requests that skip those checks. With credentials that include the permission arn:aws:s3:::* and with Console API access enabled, the attacker can write objects into buckets they should not control. This is not a remote unauthenticated exploit; it requires valid credentials of a certain breadth plus Console API reachability. No public ransomware association has been documented for this CVE.

Am I affected? How to find it in your systems

MinIO is commonly deployed as self-hosted S3-compatible object storage—on Kubernetes, bare metal, or virtual machines—serving application data, backups, or multi-tenant storage. Inventory every MinIO instance by searching configuration management databases, container registries, Helm charts, and network scans for MinIO ports and the Console UI. Confirm whether the Console API is enabled and whether any identities hold the broad permission arn:aws:s3:::* . Review IAM-style policies and access keys for that pattern. Check vendor release notes and the official advisory to determine which of your installed versions are vulnerable; do not rely on version numbers stated elsewhere. Look for anomalous object puts into unexpected buckets, especially those originating from Console API sessions or from identities that should have limited write scope. Enable and review audit logs for PostPolicyBucket activity and unexpected bucket writes.

How to remediate

Apply the vendor-supplied update that addresses CVE-2023-28434 as soon as it can be validated in your environment; follow the exact upgrade path and any configuration changes listed in the MinIO advisory. After patching, re-verify that Console API access is still required only where necessary and that no identity retains the overly broad arn:aws:s3:::* permission unless it is strictly justified. Tighten least-privilege policies so that write rights are scoped to specific buckets. Rotate any credentials that may have been exposed or used during the vulnerable period. Re-test PostPolicyBucket behavior with non-privileged accounts to confirm the bypass is closed. If mitigations cannot be applied, CISA guidance is to discontinue use of the product until a fix is available.

If you can't patch immediately

Reduce exposure while you schedule the update. Disable or tightly restrict Console API access at the network layer—limit it to management jump hosts or VPN segments and block it from general application networks. Segment MinIO so that only authorized application subnets can reach the data plane. Apply virtual patching or WAF rules that inspect and reject anomalous PostPolicyBucket requests if your edge devices support such signatures; confirm rule efficacy against the vendor description. Temporarily remove or narrow the arn:aws:s3:::* permission from all but the most essential service accounts. Increase monitoring for unexpected object creation across buckets and alert on Console API authentication from unusual sources. These steps lower risk but do not replace the vendor patch.

If your data may have been exposed

Actively exploited privilege-escalation flaws can lead to unauthorized data placement or later exfiltration. Review access logs for the period the vulnerable version was running, identify any unexpected objects or policy changes, and treat affected buckets as potentially compromised until verified clean. Rotate credentials and re-evaluate data integrity. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether related accounts appear in public dumps.