| 제목 | minio minio RELEASE.2025-10-15T17-29-55Z Improper Verification of Cryptographic Signature |
|---|
| 설명 | When MinIO is configured with an OIDC identity provider using a Public Client (OAuth 2.0 public client type, where client_secret is empty), the function PopulatePublicKey() stores []byte("") as an HMAC signing key in the public key map, keyed by the client_id.
The JWT validation function Validate() includes HS256, HS384, and HS512 in its ValidMethods list. An attacker who knows the client_id can forge a JWT with alg: HS256 and kid: <client_id>, signed using the empty byte slice as the HMAC key. MinIO accepts this forged JWT at the unauthenticated AssumeRoleWithWebIdentity STS endpoint and issues valid temporary AWS credentials.
The attacker controls all JWT claims including the policy claim, allowing them to assume any IAM policy (e.g., consoleAdmin) and gain full read/write access to all S3 data. |
|---|
| 원천 | ⚠️ https://github.com/zast-ai/vulnerability-reports/blob/main/minio/jwt_forgery.md |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 11:24 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 20. AM 10:04 (21 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 351748 [MinIO JWT 약한 인증] |
|---|
| 포인트들 | 0 |
|---|