---
id: CVE-2023-28434
aliases:
  - GHSA-2pxw-r47w-4p8c
  - BIT-minio-2023-28434
title: Privilege Escalation on Linux/MacOS
summary: Privilege Escalation on Linux/MacOS
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H'
exploited: true
vendor: minio
product: github.com/minio/minio
ecosystem: go
affected:
  - github.com/minio/minio < 0.0.0-202303200415
patched:
  - github.com/minio/minio 0.0.0-202303200415
published: '2023-09-05'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:03.189234471Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2pxw-r47w-4p8c'
references:
  - url: 'https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-28434'
  - url: 'https://github.com/minio/minio/pull/16849'
  - url: >-
      https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5
  - url: 'https://github.com/minio/minio'
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434
tags:
  - osv
  - go
  - kev
  - in-the-wild
  - exploit-available
epss: 0.07917
epssPercentile: 0.94511
kev: true
kevDateAdded: '2023-09-19'
kevDueDate: '2023-10-10'
kevRansomware: false
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/AbelChe/evil_minio'
  checkedAt: '2026-09-25T08:20:41.609Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.746Z'
---

## Overview

### Impact
An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

### Patches
```
commit 67f4ba154a27a1b06e48bfabda38355a010dfca5
Author: Aditya Manthramurthy <donatello@users.noreply.github.com>
Date:   Sun Mar 19 21:15:20 2023 -0700

    fix: post policy request security bypass (#16849)
```

### Workarounds
Browser API access must be enabled turning off `MINIO_BROWSER=off` allows for this workaround.

### References
The vulnerable code:
```go
// minio/cmd/generic-handlers.go
func setRequestValidityHandler(h http.Handler) http.Handler {
  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    // ...
    // For all other requests reject access to reserved buckets
    bucketName, _ := request2BucketObjectName(r)
    if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {
      if !guessIsRPCReq(r) && !guessIsBrowserReq(r) && !guessIsHealthCheckReq(r) && !guessIsMetricsReq(r) && !isAdminReq(r) && !isKMSReq(r) {
        if ok {
          tc.FuncName = "handler.ValidRequest"
          tc.ResponseRecorder.LogErrBody = true
        }
        writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL)
        return
      }
    }
    // ...
```

## Affected packages

- `github.com/minio/minio < 0.0.0-202303200415`

## Remediation

Upgrade to a patched release:

- `github.com/minio/minio 0.0.0-202303200415`