Recently received a MinIO vulnerability alert from the security department

At first glance, this vulnerability looks pretty disastrous—it needs to be fixed promptly.

And so, I began working on the upgrade.

First, confirm that the MinIO version we are using is 2021-03-26T00:00:41Z 

This version was chosen because it is licensed under Apache License 2.0 ,the last MinIO version that permits free commercial use without requiring source code disclosure.

After this version, MinIO changed its license to AGPL V3.

According to the report, this vulnerability

Confirmed affected versions: RELEASE.2019-12-17T23-16-33Z <= MinIO < RELEASE.2023-03-20T20-16-18Z

Fixed version: RELEASE.2023-03-20T20-16-18Z

The version we currently use is among the affected versions.

Because the version we use is so old, we do not dare upgrade to a new major version.

So I considered downloading the source code myself and patching it based on the portions of source code disclosed in the report.

// minio/cmd/bootstrap-peer-server.go

func (b *bootstrapRESTServer) VerifyHandler(w http.ResponseWriter, r *http.Request) {  ctx := newContext(r, w, "VerifyHandler")  cfg := getServerSystemCfg()  logger.LogIf(ctx, json.NewEncoder(w).Encode(&cfg)) }

// minio/cmd/bootstrap-peer-server.go

func getServerSystemCfg() ServerSystemConfig {  envs := env.List("MINIO_")  envValues := make(map[string]string, len(envs))  for _, envK := range envs {    // skip certain environment variables as part    // of the whitelist and could be configured    // differently on each nodes, update skipEnvs()    // map if there are such environment values    if _, ok := skipEnvs[envK]; ok {      continue    }    envValues[envK] = env.Get(envK, "")  }  return ServerSystemConfig{    MinioEndpoints: globalEndpoints,    MinioEnv:       envValues,  } }

But after downloading the source code and switching to the version branch we were using, I discovered that this version did not contain the code shown in the report

func (b *bootstrapRESTServer) VerifyHandler(w http.ResponseWriter, r *http.Request) {
    ctx := newContext(r, w, "VerifyHandler")
    cfg := getServerSystemCfg()
    logger.LogIf(ctx, json.NewEncoder(w).Encode(&cfg))
    w.(http.Flusher).Flush()
}

func getServerSystemCfg() ServerSystemConfig {
    return ServerSystemConfig{
       MinioPlatform:  fmt.Sprintf("OS: %s | Arch: %s", runtime.GOOS, runtime.GOARCH),
       MinioEndpoints: globalEndpoints,
    }
}

Oh no, what's going on? What's going on?What happened?

According to the report, a verification tool is available to verify this vulnerability.https://github.com/MzzdToT/CVE-2023-28432

We downloaded the vulnerability verification code, and the results of running it showed that the version we use is unaffected.

At this point, I began to suspect that the version range in the report was wrong, so I compared the MinIO source code

Comparing the code revealed that the versions actually incorporating this defect began with RELEASE.2021-08-31T05-46-54Z

I still could not confirm whether my guess was correct, so I began looking for the vulnerability advisory on MinIO’s official website 

https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q

The truth is now out: MinIO has officially provided the correct affected versions

Affected versions

RELEASE.2021-08-31T05-46-54Z

Patched versions

RELEASE.2023-03-20T20-16-18Z

The version we use is outside the range of affected versions.

After this incident, I searched for many articles.

Sigh, these domestic security vendors just keep copying one another.

This article 

https://cloud.tencent.com/developer/article/2315008 

Plagiarism  

https://www.h3c.com/cn/d_202304/1830808_30003_0.htm

this article

https://www.h3c.com/cn/d_202304/1830808_30003_0.htm 

Plagiarizing again

 https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q

It turned out it had even copied the wrong version—what a pain!

Below, I'm going to post the links to the articles I found. They're all a bunch of useless garbage, and I'm going to thoroughly drag them through the mud

https://stack.chaitin.com/techblog/detail/62

https://mp.weixin.qq.com/s/JgskenAZ6Cpecoe2k2AEjQ

https://blog.nsfocus.net/miniocve-2023-28432/

https://www.freebuf.com/vuls/363647.html

https://cloud.tencent.com/developer/article/2315008

https://www.h3c.com/cn/d_202304/1830808_30003_0.htm

https://zone.huoxian.cn/d/2708-cve-2023-28432-minio/17

https://www.cve.org/CVERecord?id=CVE-2023-28432