Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

2023-05-2613:57:27

Google

osv.dev

minio

console

object

security

unicode

filename

exploit

report

patch

workaround

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

40.2%

JSON

Impact

Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.

Reported-By

Thanks to the report from Mio Li [email protected]

Patches

commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
Author: Daniel Valdivia &lt;18384552+dvaldivia@users.noreply.github.com&gt;
Date:   Tue May 23 08:47:12 2023 -0700

    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)
    
    Signed-off-by: Daniel Valdivia &lt;18384552+dvaldivia@users.noreply.github.com&gt;

Workarounds

Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.