{"vulnerability": "CVE-2023-28434", "sightings": [{"uuid": "2d67b252-4264-4580-b523-ce045a7ba9f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-09-19T18:10:01.000000Z"}, {"uuid": "391b3872-b2fe-46f1-9608-d29ce2f2e418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971887", "content": "", "creation_timestamp": "2024-12-24T20:35:16.036816Z"}, {"uuid": "35eab2e2-6509-4a30-a0a2-98bf4d3ef009", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://bsky.app/profile/gothburz.bsky.social/post/3lezuydfphi2n", "content": "", "creation_timestamp": "2025-01-06T00:30:35.010698Z"}, {"uuid": "c46eac71-7b9d-4312-adb2-6dea4c1d744d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:46.000000Z"}, {"uuid": "be5c43b8-7c7c-4e03-8d0d-5c825a9206bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0df09428-2a3f-49b5-9106-82db439c7146", "content": "", "creation_timestamp": "2026-02-02T12:26:50.226352Z"}, {"uuid": "3d0b74b3-d2f2-444f-a0f7-cc854200bd5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4018", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28434 nuclei templates\nURL\uff1ahttps://github.com/Mr-xn/CVE-2023-28432\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-03-23T15:55:52.000000Z"}, {"uuid": "4b97b7b7-701a-4123-890e-10bf16502551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4052", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aEXP for CVE-2023-28434 MinIO unauthorized to RCE\nURL\uff1ahttps://github.com/AbelChe/evil_minio\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-03-27T09:01:16.000000Z"}, {"uuid": "b18be476-5f9a-4b82-997a-3d7aa5c3f47d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4016", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28434 nuclei templates\nURL\uff1ahttps://github.com/Mr-xn/CVE-2023-28434\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-03-23T14:52:47.000000Z"}, {"uuid": "d5887121-cb7d-4a7b-af6a-f8791cd52ecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3201", "content": "Hackers Factory \n\nA collection of resources for linux reverse engineering\n\nhttps://github.com/michalmalik/linux-re-101\n\nA tool for checking the security hardening options of the Linux kernel\n\nhttps://github.com/a13xp0p0v/kernel-hardening-checker\n\nA tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain.\n\nhttps://github.com/ShorSec/ShadowSpray\n\nEXP for CVE-2023-28434 MinIO unauthorized to RCE\n\nhttps://github.com/AbelChe/evil_minio\n\nThis is a Proof of Concept (PoC) for CVE-2023-3244, a vulnerability in comment-like-dislike. The PoC demonstrates the exploitability of this vulnerability and serves as a reference for security researchers and developers to better understand and mitigate the risk associated with this issue.\n\nhttps://github.com/drnull03/POC-CVE-2023-3244\n\nNextdoor's Cloud Security Posture Management (CSPM) Evaluation Matrix\n\nhttps://github.com/Nextdoor/cspm_evaluation_matrix\n\nMass Exploit - CVE-2023-1698 < Unauthenticated Remote Command Execution\n\nhttps://github.com/codeb0ss/CVE-2023-1698-PoC\n\nPassive subdomain continous monitoring tool\n\nhttps://github.com/e1abrador/sub.Monitor\n\nAn exploit for OpenTSDB <= 2.4.1 cmd injection (CVE-2023-36812/CVE-2023-25826) written in Fortran\n\nhttps://github.com/ErikWynter/opentsdb_key_cmd_injection\n\nA collection of awesome one-liners for bug bounty hunting.\n\nhttps://github.com/0xPugazh/One-Liners\n\nThis is a useful Python script for extracting bug bounty.\n\nhttps://github.com/St74nger/writeup-miner\n\nThis repository serves as a comprehensive collection of essential wordlists utilized by bug hunters, penetration testers, and security enthusiasts during their reconnaissance and vulnerability assessment processes.\n\nhttps://github.com/bhavesh-pardhi/Wordlist-Hub\n\nKQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.\n\nhttps://github.com/Bert-JanP/Hunting-Queries-Detection-Rules\n\n#infosec #cybersecurity #hackersfactory \n\nhttps://t.me/dilagrafie", "creation_timestamp": "2023-10-23T21:34:09.000000Z"}, {"uuid": "4064801a-de52-4482-b7dd-96ef2a4b5422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/cibsecurity/60516", "content": "\u203c CVE-2023-28434 \u203c\n\nMinio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-03-22T23:35:58.000000Z"}, {"uuid": "f52e8e4f-ae70-4b94-bb32-f6883aa02d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/CVEhub/8986", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-28434*\nGithub: https://github.com/Mr-xn/CVE-2023-28434", "creation_timestamp": "2026-07-30T01:00:49.048549Z"}, {"uuid": "99db11af-0505-46a6-ab78-28038d9b2d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://t.me/thehackernews/3824", "content": "An unknown attacker exploited vulnerabilities (CVE-2023-28432 and CVE-2023-28434) in MinIO storage system for unauthorized code execution. How did they backdoor it? \n \nDetails revealed by Security Joes: https://thehackernews.com/2023/09/hackers-exploit-minio-storage-system.html", "creation_timestamp": "2023-09-04T16:15:50.000000Z"}, {"uuid": "66d89f17-aa6a-4c98-b170-1cdaa2562d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/1110", "content": "https://github.com/AbelChe/evil_minio\nEXP for CVE-2023-28434 MinIO unauthorized to RCE\n\nCVE\u51fa\u53e3-2023-28434 MinIO\u672a\u6388\u6743\u5230RCE\n#github #exploit", "creation_timestamp": "2023-10-09T18:28:04.000000Z"}, {"uuid": "7d837377-a6d2-4395-be6a-003ee75a1186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9015", "content": "#exploit\n1. CVE-2023-28434:\nMinIO unauthorized to RCE\nhttps://github.com/AbelChe/evil_minio\n\n2. CVE-2023-3959, CVE-2023-4249:\nMultiple critical vulnerabilities in Zavio IP cameras\nhttps://bugprove.com/knowledge-hub/cve-2023-3959-cve-2023-4249-multiple-critical-vulnerabilities-in-zavio-ip-cameras\n\n3. CVE-2023-4809:\nFreeBSD pf bypass when using IPv6\nhttps://www.enricobassetti.it/2023/09/cve-2023-4809-freebsd-pf-bypass-when-using-ipv6", "creation_timestamp": "2023-09-13T11:01:01.000000Z"}, {"uuid": "a47818ec-f452-4e4a-8059-46b5e9273a84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/Rootsec_2/962", "content": "#exploit\n1. CVE-2023-28434:\nMinIO unauthorized to RCE\nhttps://github.com/AbelChe/evil_minio\n\n2. CVE-2023-3959, CVE-2023-4249:\nMultiple critical vulnerabilities in Zavio IP cameras\nhttps://bugprove.com/knowledge-hub/cve-2023-3959-cve-2023-4249-multiple-critical-vulnerabilities-in-zavio-ip-cameras\n\n3. CVE-2023-4809:\nFreeBSD pf bypass when using IPv6\nhttps://www.enricobassetti.it/2023/09/cve-2023-4809-freebsd-pf-bypass-when-using-ipv6", "creation_timestamp": "2024-08-16T08:24:29.000000Z"}, {"uuid": "261c76cc-44f8-4179-86d1-89d3a449d3d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/8986", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-28434*\nGithub: https://github.com/Mr-xn/CVE-2023-28434", "creation_timestamp": "2026-07-31T12:00:04.264798Z"}, {"uuid": "69771e46-451b-4949-b66e-1297a2c55929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/8986", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-28434*\nGithub: https://github.com/Mr-xn/CVE-2023-28434", "creation_timestamp": "2026-08-01T00:00:32.791242Z"}, {"uuid": "aaf74412-aead-4e60-abe7-2a8bfd0d618c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6a8188d3-b15e-4ff3-a2d2-09a89115e612", "content": "", "creation_timestamp": "2026-06-19T12:46:48.737999Z"}, {"uuid": "bcf361f4-e8ce-469e-a18b-bf0f0500e024", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/88edd5f2-8531-4443-a383-308daee4e150", "content": "", "creation_timestamp": "2026-06-23T14:05:45.726805Z"}, {"uuid": "b9d48c3b-277e-480a-91d5-3e8e6cb3e7a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/EchelonEyes/1929", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 MinIO \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f MinIO. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Security Joes, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b, \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b MinIO.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 CVE-2023-28432  (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,5) \u0438 CVE-2023-28434 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8), \u043f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA).\n\n\u0414\u0432\u0430 \u044d\u0442\u0438\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u00ab\u043c\u043e\u0433\u0443\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435, \u0438 \u043e\u0431\u043b\u0435\u0433\u0447\u0438\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435, \u0433\u0434\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 MinIO\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 Security Joes.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e \u043a\u0430\u043a \u043f\u043b\u0430\u0446\u0434\u0430\u0440\u043c, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442 MinIO \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u0443\u044e \u0442\u0440\u043e\u044f\u043d\u043e\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c MIRROR_URL.\n\n\u00ab\u041a\u043e\u043c\u0430\u043d\u0434\u0430 mc admin update \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442 \u0432\u0441\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b MinIO \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 MinIO. \u2013 \u042d\u0442\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0447\u0430\u0441\u0442\u043d\u043e\u0433\u043e \u0437\u0435\u0440\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0441\u0440\u0435\u0434, \u0433\u0434\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u00bb.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u044b\u0439 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b MinIO \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043a\u0430\u043a \u0431\u044d\u043a\u0434\u043e\u0440. \u041a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043f\u0438\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Evil MinIO, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043f\u0440\u0435\u043b\u044f 2023 \u0433\u043e\u0434\u0430. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u043c\u0435\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 Bash \u0438 Python, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440-\u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430. \u0421\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043a\u0430\u043a \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 Windows, \u0442\u0430\u043a \u0438 \u0432 Linux, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0448\u043b\u044e\u0437 \u0434\u043b\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u043e\u043b\u0436\u043d\u043e \u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u044b\u0442\u044c \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u043e \u0438\u043b\u0438 \u043d\u0435\u0442. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u00ab\u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043a \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-26T02:02:23.081596Z"}, {"uuid": "b8603afa-7df6-4d4c-98ca-d04e400f10d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/EchelonEyes/1929", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 MinIO \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f MinIO. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Security Joes, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b, \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b MinIO.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 CVE-2023-28432  (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,5) \u0438 CVE-2023-28434 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8), \u043f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA).\n\n\u0414\u0432\u0430 \u044d\u0442\u0438\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u00ab\u043c\u043e\u0433\u0443\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435, \u0438 \u043e\u0431\u043b\u0435\u0433\u0447\u0438\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435, \u0433\u0434\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 MinIO\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 Security Joes.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e \u043a\u0430\u043a \u043f\u043b\u0430\u0446\u0434\u0430\u0440\u043c, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442 MinIO \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u0443\u044e \u0442\u0440\u043e\u044f\u043d\u043e\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c MIRROR_URL.\n\n\u00ab\u041a\u043e\u043c\u0430\u043d\u0434\u0430 mc admin update \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442 \u0432\u0441\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b MinIO \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 MinIO. \u2013 \u042d\u0442\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0447\u0430\u0441\u0442\u043d\u043e\u0433\u043e \u0437\u0435\u0440\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0441\u0440\u0435\u0434, \u0433\u0434\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u00bb.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u044b\u0439 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b MinIO \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043a\u0430\u043a \u0431\u044d\u043a\u0434\u043e\u0440. \u041a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043f\u0438\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Evil MinIO, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043f\u0440\u0435\u043b\u044f 2023 \u0433\u043e\u0434\u0430. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u043c\u0435\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 Bash \u0438 Python, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440-\u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430. \u0421\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043a\u0430\u043a \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 Windows, \u0442\u0430\u043a \u0438 \u0432 Linux, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0448\u043b\u044e\u0437 \u0434\u043b\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u043e\u043b\u0436\u043d\u043e \u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u044b\u0442\u044c \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u043e \u0438\u043b\u0438 \u043d\u0435\u0442. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u00ab\u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043a \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-27T00:00:58.740494Z"}, {"uuid": "5af38405-33d1-413c-a5db-19dd7af5402a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/1929", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 MinIO \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f MinIO. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Security Joes, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b, \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b MinIO.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 CVE-2023-28432  (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,5) \u0438 CVE-2023-28434 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8), \u043f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA).\n\n\u0414\u0432\u0430 \u044d\u0442\u0438\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u00ab\u043c\u043e\u0433\u0443\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435, \u0438 \u043e\u0431\u043b\u0435\u0433\u0447\u0438\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435, \u0433\u0434\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 MinIO\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 Security Joes.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e \u043a\u0430\u043a \u043f\u043b\u0430\u0446\u0434\u0430\u0440\u043c, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442 MinIO \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u0443\u044e \u0442\u0440\u043e\u044f\u043d\u043e\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c MIRROR_URL.\n\n\u00ab\u041a\u043e\u043c\u0430\u043d\u0434\u0430 mc admin update \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442 \u0432\u0441\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b MinIO \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 MinIO. \u2013 \u042d\u0442\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0447\u0430\u0441\u0442\u043d\u043e\u0433\u043e \u0437\u0435\u0440\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0441\u0440\u0435\u0434, \u0433\u0434\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u00bb.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u044b\u0439 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b MinIO \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043a\u0430\u043a \u0431\u044d\u043a\u0434\u043e\u0440. \u041a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043f\u0438\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Evil MinIO, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043f\u0440\u0435\u043b\u044f 2023 \u0433\u043e\u0434\u0430. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u043c\u0435\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 Bash \u0438 Python, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440-\u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430. \u0421\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043a\u0430\u043a \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 Windows, \u0442\u0430\u043a \u0438 \u0432 Linux, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0448\u043b\u044e\u0437 \u0434\u043b\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u043e\u043b\u0436\u043d\u043e \u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u044b\u0442\u044c \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u043e \u0438\u043b\u0438 \u043d\u0435\u0442. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u00ab\u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043a \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-28T00:00:24.978272Z"}, {"uuid": "09853446-dfff-49b4-8a58-76ecccca0346", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/CVEhub/8986", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-28434*\nGithub: https://github.com/Mr-xn/CVE-2023-28434", "creation_timestamp": "2026-07-29T12:00:45.824213Z"}, {"uuid": "68566e9b-4ca6-4cb8-b956-8211c5d51083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/hacking_Attack/117272", "content": "Black Hat Ethical Hacking\nMinIO Under Siege: Threat Actor Exploits Critical Vulnerabilities\n\nMinIO Under Siege: Threat Actor Exploits Critical VulnerabilitiesPost Views: 16 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a concerning development, an unidentified threat actor has been observed exploiting high-severity security vulnerabilities in the MinIO high-performance object storage system. This intrusion technique enables the attacker to achieve unauthorized code execution on targeted servers, potentially leading to significant data breaches.\n\nSecurity Joes, a renowned cybersecurity and incident response firm, uncovered this threat and detailed its findings. The attacker\u2019s strategy involved leveraging a publicly available exploit chain to establish a backdoor within the MinIO instance.\n\nThis alarming breach hinged on two specific vulnerabilities: CVE-2023-28432, with a CVSS score of 7.5, and CVE-2023-28434, rated at 8.8. Notably, CVE-2023-28432 was added to the U.S. Cybersecurity and Infrastructure Security Agency\u2019s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.\n\nBoth of these vulnerabilities possessed the potential to expose sensitive data housed within the compromised MinIO installation. Furthermore, they facilitated remote code execution (RCE) on the host where the MinIO application was operational.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nSecurity Joes\u2019 investigation unveiled a troubling attack chain. The threat actor weaponized these vulnerabilities to acquire administrator credentials. With these credentials in hand, they exploited their foothold to replace the legitimate MinIO client on the host with a trojanized version. This was accomplished by triggering an update command, specifying a MIRROR_URL.\n\nThe MinIO documentation explains the update command\u2019s purpose, which is to update all MinIO servers in the deployment, including support for private mirror servers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtxGNZXuVuVVEjMfgBCof2eB4K4Q_wTRfnUz76yNe2sxsfMGdrUrIYwTREDPstpq-lezu9lCUrBctxUJ4Ys7vYgTqvZGLG_JEh2qHN94NjjaDVdZJWbufznrycG3R-Oj3nRrv6-gSDF4oJmbO56zeTjUd-q7Unka3zJ0mSPR71YXXCvA-vDXyrOTLhggSS/s728-e3650/mini.jpg \n\nThe consequences of these actions were severe. By replacing the authentic MinIO binary with a malicious counterpart, the attacker effectively sealed the compromise of the system. The tampered binary introduced an endpoint that executed commands via HTTP requests, effectively serving as a surreptitious backdoor. The executed commands inherited the system permissions of the user who initiated the application.\n\nIt\u2019s worth highlighting that the modified binary bore a striking resemblance to an exploit named Evil MinIO, which had been published on GitHub in early April 2023. However, at this juncture, there is no concrete evidence linking the exploit\u2019s author to the attackers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgZOIwjwz8Pc0e0gGfarkAZ-2lBiPHk73c14zuMYodOis8OGDSzPQdgKQZu3c6MdLOJpTb2gwG0vALlSVs2i3LZOPyZUfcYLzsuozxa3XVt4SR1Kw1QFP8ImRhgKn61aimfmaZX0hX43ihCyJvn9Shrf78vQgdMWrl-2lNBXWadOym3AaASxKc7aQFRI2n_/s728-e3650/shodan.jpg \nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt What is clear, though, is the proficiency of the threat actor. They demonstrated adeptness in working with bash scripts and Python, leveraging their backdoor access to deliver supplementary payloads from a remote server for post-exploitation via a downloader script.\n\nThis downloader script exhibited versatility by targeting both Windows and Linux env[...]", "creation_timestamp": "2026-09-01T20:00:52.088454Z"}, {"uuid": "213ec89c-b985-4978-a381-e44c00a5e317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "seen", "source": "https://t.me/hacking_Attack/117272", "content": "Black Hat Ethical Hacking\nMinIO Under Siege: Threat Actor Exploits Critical Vulnerabilities\n\nMinIO Under Siege: Threat Actor Exploits Critical VulnerabilitiesPost Views: 16 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a concerning development, an unidentified threat actor has been observed exploiting high-severity security vulnerabilities in the MinIO high-performance object storage system. This intrusion technique enables the attacker to achieve unauthorized code execution on targeted servers, potentially leading to significant data breaches.\n\nSecurity Joes, a renowned cybersecurity and incident response firm, uncovered this threat and detailed its findings. The attacker\u2019s strategy involved leveraging a publicly available exploit chain to establish a backdoor within the MinIO instance.\n\nThis alarming breach hinged on two specific vulnerabilities: CVE-2023-28432, with a CVSS score of 7.5, and CVE-2023-28434, rated at 8.8. Notably, CVE-2023-28432 was added to the U.S. Cybersecurity and Infrastructure Security Agency\u2019s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.\n\nBoth of these vulnerabilities possessed the potential to expose sensitive data housed within the compromised MinIO installation. Furthermore, they facilitated remote code execution (RCE) on the host where the MinIO application was operational.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nSecurity Joes\u2019 investigation unveiled a troubling attack chain. The threat actor weaponized these vulnerabilities to acquire administrator credentials. With these credentials in hand, they exploited their foothold to replace the legitimate MinIO client on the host with a trojanized version. This was accomplished by triggering an update command, specifying a MIRROR_URL.\n\nThe MinIO documentation explains the update command\u2019s purpose, which is to update all MinIO servers in the deployment, including support for private mirror servers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtxGNZXuVuVVEjMfgBCof2eB4K4Q_wTRfnUz76yNe2sxsfMGdrUrIYwTREDPstpq-lezu9lCUrBctxUJ4Ys7vYgTqvZGLG_JEh2qHN94NjjaDVdZJWbufznrycG3R-Oj3nRrv6-gSDF4oJmbO56zeTjUd-q7Unka3zJ0mSPR71YXXCvA-vDXyrOTLhggSS/s728-e3650/mini.jpg \n\nThe consequences of these actions were severe. By replacing the authentic MinIO binary with a malicious counterpart, the attacker effectively sealed the compromise of the system. The tampered binary introduced an endpoint that executed commands via HTTP requests, effectively serving as a surreptitious backdoor. The executed commands inherited the system permissions of the user who initiated the application.\n\nIt\u2019s worth highlighting that the modified binary bore a striking resemblance to an exploit named Evil MinIO, which had been published on GitHub in early April 2023. However, at this juncture, there is no concrete evidence linking the exploit\u2019s author to the attackers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgZOIwjwz8Pc0e0gGfarkAZ-2lBiPHk73c14zuMYodOis8OGDSzPQdgKQZu3c6MdLOJpTb2gwG0vALlSVs2i3LZOPyZUfcYLzsuozxa3XVt4SR1Kw1QFP8ImRhgKn61aimfmaZX0hX43ihCyJvn9Shrf78vQgdMWrl-2lNBXWadOym3AaASxKc7aQFRI2n_/s728-e3650/shodan.jpg \nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt What is clear, though, is the proficiency of the threat actor. They demonstrated adeptness in working with bash scripts and Python, leveraging their backdoor access to deliver supplementary payloads from a remote server for post-exploitation via a downloader script.\n\nThis downloader script exhibited versatility by targeting both Windows and Linux env[...]", "creation_timestamp": "2026-09-02T01:01:11.790701Z"}, {"uuid": "1db888b1-d9ca-42cf-96ac-ba223a46ee2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://t.me/hacking_Attack/117272", "content": "Black Hat Ethical Hacking\nMinIO Under Siege: Threat Actor Exploits Critical Vulnerabilities\n\nMinIO Under Siege: Threat Actor Exploits Critical VulnerabilitiesPost Views: 16 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a concerning development, an unidentified threat actor has been observed exploiting high-severity security vulnerabilities in the MinIO high-performance object storage system. This intrusion technique enables the attacker to achieve unauthorized code execution on targeted servers, potentially leading to significant data breaches.\n\nSecurity Joes, a renowned cybersecurity and incident response firm, uncovered this threat and detailed its findings. The attacker\u2019s strategy involved leveraging a publicly available exploit chain to establish a backdoor within the MinIO instance.\n\nThis alarming breach hinged on two specific vulnerabilities: CVE-2023-28432, with a CVSS score of 7.5, and CVE-2023-28434, rated at 8.8. Notably, CVE-2023-28432 was added to the U.S. Cybersecurity and Infrastructure Security Agency\u2019s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.\n\nBoth of these vulnerabilities possessed the potential to expose sensitive data housed within the compromised MinIO installation. Furthermore, they facilitated remote code execution (RCE) on the host where the MinIO application was operational.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nSecurity Joes\u2019 investigation unveiled a troubling attack chain. The threat actor weaponized these vulnerabilities to acquire administrator credentials. With these credentials in hand, they exploited their foothold to replace the legitimate MinIO client on the host with a trojanized version. This was accomplished by triggering an update command, specifying a MIRROR_URL.\n\nThe MinIO documentation explains the update command\u2019s purpose, which is to update all MinIO servers in the deployment, including support for private mirror servers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtxGNZXuVuVVEjMfgBCof2eB4K4Q_wTRfnUz76yNe2sxsfMGdrUrIYwTREDPstpq-lezu9lCUrBctxUJ4Ys7vYgTqvZGLG_JEh2qHN94NjjaDVdZJWbufznrycG3R-Oj3nRrv6-gSDF4oJmbO56zeTjUd-q7Unka3zJ0mSPR71YXXCvA-vDXyrOTLhggSS/s728-e3650/mini.jpg \n\nThe consequences of these actions were severe. By replacing the authentic MinIO binary with a malicious counterpart, the attacker effectively sealed the compromise of the system. The tampered binary introduced an endpoint that executed commands via HTTP requests, effectively serving as a surreptitious backdoor. The executed commands inherited the system permissions of the user who initiated the application.\n\nIt\u2019s worth highlighting that the modified binary bore a striking resemblance to an exploit named Evil MinIO, which had been published on GitHub in early April 2023. However, at this juncture, there is no concrete evidence linking the exploit\u2019s author to the attackers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgZOIwjwz8Pc0e0gGfarkAZ-2lBiPHk73c14zuMYodOis8OGDSzPQdgKQZu3c6MdLOJpTb2gwG0vALlSVs2i3LZOPyZUfcYLzsuozxa3XVt4SR1Kw1QFP8ImRhgKn61aimfmaZX0hX43ihCyJvn9Shrf78vQgdMWrl-2lNBXWadOym3AaASxKc7aQFRI2n_/s728-e3650/shodan.jpg \nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt What is clear, though, is the proficiency of the threat actor. They demonstrated adeptness in working with bash scripts and Python, leveraging their backdoor access to deliver supplementary payloads from a remote server for post-exploitation via a downloader script.\n\nThis downloader script exhibited versatility by targeting both Windows and Linux env[...]", "creation_timestamp": "2026-09-04T09:00:05.201680Z"}, {"uuid": "5269801b-6148-452a-90cf-74ebecc9911c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28434", "type": "exploited", "source": "https://t.me/hacking_Attack/117272", "content": "Black Hat Ethical Hacking\nMinIO Under Siege: Threat Actor Exploits Critical Vulnerabilities\n\nMinIO Under Siege: Threat Actor Exploits Critical VulnerabilitiesPost Views: 16 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a concerning development, an unidentified threat actor has been observed exploiting high-severity security vulnerabilities in the MinIO high-performance object storage system. This intrusion technique enables the attacker to achieve unauthorized code execution on targeted servers, potentially leading to significant data breaches.\n\nSecurity Joes, a renowned cybersecurity and incident response firm, uncovered this threat and detailed its findings. The attacker\u2019s strategy involved leveraging a publicly available exploit chain to establish a backdoor within the MinIO instance.\n\nThis alarming breach hinged on two specific vulnerabilities: CVE-2023-28432, with a CVSS score of 7.5, and CVE-2023-28434, rated at 8.8. Notably, CVE-2023-28432 was added to the U.S. Cybersecurity and Infrastructure Security Agency\u2019s (CISA) Known Exploited Vulnerabilities (KEV) catalog on April 21, 2023.\n\nBoth of these vulnerabilities possessed the potential to expose sensitive data housed within the compromised MinIO installation. Furthermore, they facilitated remote code execution (RCE) on the host where the MinIO application was operational.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nSecurity Joes\u2019 investigation unveiled a troubling attack chain. The threat actor weaponized these vulnerabilities to acquire administrator credentials. With these credentials in hand, they exploited their foothold to replace the legitimate MinIO client on the host with a trojanized version. This was accomplished by triggering an update command, specifying a MIRROR_URL.\n\nThe MinIO documentation explains the update command\u2019s purpose, which is to update all MinIO servers in the deployment, including support for private mirror servers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtxGNZXuVuVVEjMfgBCof2eB4K4Q_wTRfnUz76yNe2sxsfMGdrUrIYwTREDPstpq-lezu9lCUrBctxUJ4Ys7vYgTqvZGLG_JEh2qHN94NjjaDVdZJWbufznrycG3R-Oj3nRrv6-gSDF4oJmbO56zeTjUd-q7Unka3zJ0mSPR71YXXCvA-vDXyrOTLhggSS/s728-e3650/mini.jpg \n\nThe consequences of these actions were severe. By replacing the authentic MinIO binary with a malicious counterpart, the attacker effectively sealed the compromise of the system. The tampered binary introduced an endpoint that executed commands via HTTP requests, effectively serving as a surreptitious backdoor. The executed commands inherited the system permissions of the user who initiated the application.\n\nIt\u2019s worth highlighting that the modified binary bore a striking resemblance to an exploit named Evil MinIO, which had been published on GitHub in early April 2023. However, at this juncture, there is no concrete evidence linking the exploit\u2019s author to the attackers.\n\nhttps://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgZOIwjwz8Pc0e0gGfarkAZ-2lBiPHk73c14zuMYodOis8OGDSzPQdgKQZu3c6MdLOJpTb2gwG0vALlSVs2i3LZOPyZUfcYLzsuozxa3XVt4SR1Kw1QFP8ImRhgKn61aimfmaZX0hX43ihCyJvn9Shrf78vQgdMWrl-2lNBXWadOym3AaASxKc7aQFRI2n_/s728-e3650/shodan.jpg \nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt What is clear, though, is the proficiency of the threat actor. They demonstrated adeptness in working with bash scripts and Python, leveraging their backdoor access to deliver supplementary payloads from a remote server for post-exploitation via a downloader script.\n\nThis downloader script exhibited versatility by targeting both Windows and Linux env[...]", "creation_timestamp": "2026-09-05T01:00:34.478676Z"}]}