CVE-2025-31489 Scanner

MinIO is a high-performance, open-source object storage solution that is compatible with the Amazon S3 API. It is designed to handle large amounts of unstructured data, and is commonly used for cloud storage and backup solutions. MinIO is deployed in cloud-native environments, particularly within Kubernetes clusters and DevOps pipelines. It provides a fast and scalable object storage solution that integrates easily with existing systems. The software supports a wide range of use cases, from storage for web applications to backup and data archiving. MinIO is trusted by many organizations for its performance, scalability, and open-source nature.

MinIO contains a vulnerability in its signature validation mechanism, specifically in the context of unsigned trailer uploads. The issue arises when the signature component of the authorization process is invalid. As a result, an attacker with prior knowledge of the access key and bucket name, along with write permissions, can upload arbitrary objects to a bucket without proper signature verification. This vulnerability is classified as high severity because it allows unauthorized data uploads, potentially compromising data integrity and security.

The vulnerability is due to incomplete signature validation when uploading objects using the `PUT` method to the MinIO bucket. The header `Authorization` contains a signature, but the signature validation is bypassed for unsigned trailer uploads. An attacker can exploit this flaw by crafting a request that bypasses the signature check, allowing the upload of random objects to the bucket. The attack requires the attacker to have knowledge of the access key and bucket name, along with the necessary write permissions to the target bucket. This flaw does not require full access to the system, making it a serious risk for any exposed MinIO deployments.

If exploited, this vulnerability can lead to unauthorized object uploads to MinIO buckets, allowing attackers to inject arbitrary files. These files could be malicious or contain sensitive data. Since the attacker does not require valid signature verification, they could upload objects to any bucket where they have write access. The exploitation of this vulnerability can compromise data integrity and result in unauthorized access to potentially sensitive data. Attackers could also use this vulnerability to perform further attacks on the storage environment or related services.

REFERENCES

• https://github.com/minio/minio/pull/21103
• https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh