{"uuid": "68566e9b-4ca6-4cb8-b956-8211c5d51083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/hacking_Attack/117272", "content": "Black Hat Ethical Hacking\nMinIO Under Siege: Threat Actor Exploits Critical Vulnerabilities\n\nMinIO Under Siege: Threat Actor Exploits Critical VulnerabilitiesPost Views: 16 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a concerning development, an unidentified threat actor has been observed exploiting high-severity security vulnerabilities in the MinIO high-performance object storage system. This intrusion technique enables the attacker to achieve unauthorized code execution on targeted servers, potentially leading to significant data breaches.\n\nSecurity Joes, a renowned cybersecurity and incident response firm, uncovered this threat and detailed its findings. The attacker\u2019s strategy involved leveraging a publicly available exploit chain to establish a backdoor within the MinIO instance.\n\nThis alarming breach hinged on two specific vulnerabilities: CVE-2023-28432, with a CVSS score of 7.5, and CVE-2023-28434, rated at 8.8. Notably, CVE-2023-28432 was added to the U.S. Cybersecurity and Infrastructure Security Agency\u2019s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.\n\nBoth of these vulnerabilities possessed the potential to expose sensitive data housed within the compromised MinIO installation. Furthermore, they facilitated remote code execution (RCE) on the host where the MinIO application was operational.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nSecurity Joes\u2019 investigation unveiled a troubling attack chain. The threat actor weaponized these vulnerabilities to acquire administrator credentials. With these credentials in hand, they exploited their foothold to replace the legitimate MinIO client on the host with a trojanized version. This was accomplished by triggering an update command, specifying a MIRROR_URL.\n\nThe MinIO documentation explains the update command\u2019s purpose, which is to update all MinIO servers in the deployment, including support for private mirror servers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtxGNZXuVuVVEjMfgBCof2eB4K4Q_wTRfnUz76yNe2sxsfMGdrUrIYwTREDPstpq-lezu9lCUrBctxUJ4Ys7vYgTqvZGLG_JEh2qHN94NjjaDVdZJWbufznrycG3R-Oj3nRrv6-gSDF4oJmbO56zeTjUd-q7Unka3zJ0mSPR71YXXCvA-vDXyrOTLhggSS/s728-e3650/mini.jpg \n\nThe consequences of these actions were severe. By replacing the authentic MinIO binary with a malicious counterpart, the attacker effectively sealed the compromise of the system. The tampered binary introduced an endpoint that executed commands via HTTP requests, effectively serving as a surreptitious backdoor. The executed commands inherited the system permissions of the user who initiated the application.\n\nIt\u2019s worth highlighting that the modified binary bore a striking resemblance to an exploit named Evil MinIO, which had been published on GitHub in early April 2023. However, at this juncture, there is no concrete evidence linking the exploit\u2019s author to the attackers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgZOIwjwz8Pc0e0gGfarkAZ-2lBiPHk73c14zuMYodOis8OGDSzPQdgKQZu3c6MdLOJpTb2gwG0vALlSVs2i3LZOPyZUfcYLzsuozxa3XVt4SR1Kw1QFP8ImRhgKn61aimfmaZX0hX43ihCyJvn9Shrf78vQgdMWrl-2lNBXWadOym3AaASxKc7aQFRI2n_/s728-e3650/shodan.jpg \nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt What is clear, though, is the proficiency of the threat actor. They demonstrated adeptness in working with bash scripts and Python, leveraging their backdoor access to deliver supplementary payloads from a remote server for post-exploitation via a downloader script.\n\nThis downloader script exhibited versatility by targeting both Windows and Linux env[...]", "creation_timestamp": "2026-09-01T20:00:52.088454Z"}