In recent security incidents, an unknown threat actor has been observed leveraging high-severity security flaws within the MinIO high-performance object storage system. By weaponizing these vulnerabilities, the attacker has successfully achieved unauthorized code execution on affected servers. This article delves into the intrusion, exploits used, potential risks, attack strategy, command execution, and the unauthorized access gained by the adversary as a consequence.
Intrusion and Exploits
The unknown threat actor utilized a publicly available exploit chain to compromise the MinIO storage system. This allowed them to strategically backdoor the instance, gaining access and control over the targeted servers.
The attacker targeted two vulnerabilities, specifically CVE-2023-28432 and CVE-2023-28434, within the MinIO object storage system. Of particular importance is CVE-2023-28432, which received significant attention and was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.
The inclusion of CVE-2023-28432 in the CISA KEV catalog highlights the seriousness and exploitative nature of this vulnerability. This acknowledgment emphasizes the need for immediate action and heightened security measures among MinIO users.
Potential Risks and Vulnerabilities
The exploited vulnerabilities have the potential to expose sensitive information stored on compromised MinIO installations. This threat puts valuable data at risk, urging organizations to implement swift remediation strategies.
The compromised MinIO system facilitated remote code execution, enabling the threat actor to have complete control over the affected servers. The severity of this capability should not be underestimated, as it allows for unauthorized actions and potential further exploitation.
Attack Strategy and Compromise
To initiate the attack, the threat actor managed to obtain admin credentials. With these credentials, they proceeded to replace the original MinIO client with a trojanized version, further paving the way for their unauthorized access and control.
By triggering an update command that specifies a MIRROR_URL, the attacker surreptitiously replaces the legitimate MinIO binary with their malicious version. This critical step seals the compromise of the system and establishes the basis for subsequent exploitation.
The malicious modifications made to the binary during the takeover create an endpoint that acts as a backdoor. This backdoor receives and executes commands through HTTP requests, providing the threat actor with a means to control the compromised system.
Command Execution and Permissions
The established backdoor endpoint facilitates command execution by accepting HTTP requests from the threat actor. This mechanism enables the attacker to execute arbitrary commands on the compromised MinIO storage system.
Since the commands originate from the backdoor on the compromised MinIO storage system, they inherit the system permissions of the user who initiated the application. This grants the attacker significant control and may pose further security risks.
Usage of Mirror Server
By exploiting the functionality of the mc admin update command, the threat actor used a private mirror server to compromise the MinIO storage system. This approach allowed them to bypass conventional security mechanisms and proceed undetected.
The MinIO documentation suggests using the `mc admin update` command with a private mirror server in environments lacking public internet access. However, this incident highlights the potential risks associated with such configurations, as adversaries can exploit this feature for unauthorized access and control.
Consequences of Successful Compromise
The successful compromise of the MinIO storage system grants the unknown threat actor unauthorized access and full control over the affected servers. This unauthorized control poses severe risks to the confidentiality, integrity, and availability of the compromised infrastructure and the data it holds.
The recent weaponization of high-severity security flaws in the MinIO storage system by an unknown threat actor serves as yet another reminder of the persistent and evolving nature of cyber threats. It highlights the importance of prompt patching, vigilant security practices, and ongoing monitoring to protect against potential intrusions and unauthorized access. Organizations that utilize MinIO should take immediate action to remediate these vulnerabilities and implement robust security measures to safeguard their infrastructure and data from future attacks.