Minio - Information Disclosure (CVE-2023-28432)

Minio server is vulnerable to CVE-2023-28432, an Information Disclosure vulnerability in the /minio/bootstrap/v1/verify endpoint. In a cluster deployment, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in Information Disclosure.

The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.

Sniper can extract custom artefacts as evidence from the target system.

Upgrade the Minio to the latest version.

https://nvd.nist.gov/vuln/detail/CVE-2023-28432

https://ubuntu.com/security/CVE-2023-28432