| 제목 | MinIO <=RELEASE.2025-10-15T17-29-55Z Use of Hard-coded Cryptographic Key |
|---|
| 설명 | MinIO's embedded Console uses a symmetric encryption key derived via PBKDF2 to encrypt/decrypt session cookies. Both the passphrase and salt for this PBKDF2 derivation are set to globalDeploymentID (a UUID), which is leaked to unauthenticated users through S3 Select API error responses. An attacker who obtains the deploymentID can compute the exact encryption key, forge a valid Console session cookie containing root credentials, and gain full administrative access to the MinIO instance.
The vulnerability is a combination of three flaws:
Information Leak — S3 Select ParseSelectFailure errors return globalDeploymentID() as the <HostId> value, whereas standard S3 API errors use a safe SHA256(nodeName) hash.
Deterministic Key Derivation — cmd/common-main.go sets both CONSOLE_PBKDF_PASSPHRASE and CONSOLE_PBKDF_SALT to the same leaked deploymentID, making the session cookie encryption key fully computable.
Missing Credential Validation — SessionTokenAuthenticate() only checks whether the cookie can be decrypted; it does not validate the claimed STS credentials against the MinIO server. Successful decryption equals successful authentication.
|
|---|
| 원천 | ⚠️ https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 11:25 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 20. AM 10:03 (21 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 422691 [MinIO 까지 RELEASE.2025-10-15T17-29-55Z Embedded Console cmd/common-main.go globalDeploymentID/SessionTokenAuthenticate 약한 암호화] |
|---|
| 포인트들 | 20 |
|---|