CVE-2023-28432

MinIO has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all environment variables by sending a specially crafted HTTP request, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, causing sensitive information leakage, which may ultimately allow the attacker to log in to MinIO as an administrator.

Fofa Fingerprint

#app="minio"

Tool Usage

python3 minio.py -u http://127.0.0.1:1111 Single URL test

python3 minio.py -f url.txt Batch detection

After the scan, a vuln.txt file containing vulnerable URLs will be generated in the current directory.

exp：

Disclaimer

Any direct or indirect consequences and losses caused by the dissemination or use of the information provided in this document shall be borne by the user themselves. The author assumes no responsibility for this.