Minio Privilege Escalation on Windows via Path separator manipulation

CVE-2023-28433

What is CVE-2023-28433?

MinIO, a Multi-Cloud Object Storage framework, has a security flaw that allows users on Windows versions prior to RELEASE.2023-03-20T20-16-18Z to exploit the improper filtering of the \ character. This vulnerability permits low-privilege users, such as those with an access key or service account, to create an admin user by placing objects in unintended buckets. As this issue poses a significant risk, it is essential for users to upgrade to the patched version RELEASE.2023-03-20T20-16-18Z immediately, as there are no known workarounds.

References