Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Minio

## https://sploitus.com/exploit?id=B3DEECEB-27F5-5D9A-A91D-76CF3AD30517
# CVE-2023-28432  
The MinIO platform has a vulnerability related to information leakage. Unauthorized remote attackers can obtain all environment variables by sending specific HTTP requests. These variables include MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, leading to the exposure of sensitive information. This could potentially allow attackers to log in as administrators on the MinIO system.  

## Fofa Fingerprint  
#app="minio"  

## Tool Usage  
   
- `python3 minio.py -u http://127.0.0.1:1111` for testing a single URL.  
- `python3 minio.py -f url.txt` for batch detection.  
After scanning, a file named vuln.txt will be generated in the current directory, listing the vulnerable URLs.  

Example:  
![](./exp.png)  

## Disclaimer  
Any direct or indirect consequences or losses resulting from the dissemination or use of the information provided in this document are the responsibility of the user. The author assumes no responsibility for such incidents.

[source-iocs-preserved url=http://127.0.0.1:1111]