CVE-2024-36107: MinIO Object Storage Information Disclosure

CVE-2024-36107 Overview

CVE-2024-36107 is an information disclosure vulnerability in MinIO, a high-performance object storage server. The flaw allows unauthenticated attackers to determine object existence and extract metadata from private buckets by abusing HTTP conditional request headers. Specifically, the If-Modified-Since and If-Unmodified-Since headers were processed before the server validated whether anonymous access was permitted on the target object.

By sending anonymous GET requests with these headers against arbitrary object names, attackers can retrieve Last-Modified, ETag, x-amz-version-id, Expires, and Cache-Control metadata belonging to the latest version of the object. This maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate objects and extract version and cache metadata from MinIO buckets without any credentials.

Affected Products

MinIO Object Storage Server (all releases prior to RELEASE.2024-05-27T19-17-46Z)
Self-hosted MinIO deployments exposing S3-compatible HTTP endpoints
Containerized MinIO instances built from vulnerable upstream images

Discovery Timeline

2024-05-28 - CVE-2024-36107 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36107

Vulnerability Analysis

MinIO implements the S3 API precondition headers If-Modified-Since and If-Unmodified-Since to support conditional GET semantics. The server compares the client-supplied timestamp against the object's Last-Modified timestamp and returns 304 Not Modified, 412 Precondition Failed, or the object body accordingly.

The vulnerable code path evaluated these conditional checks against object metadata before enforcing the bucket's anonymous access policy. As a result, the server's response differentiates between existing and non-existing objects even when the caller has no read permission. Attackers observe status codes and response headers to infer object presence and read selected metadata fields.

Disclosed fields include Last-Modified, ETag, x-amz-version-id, Expires, and Cache-Control. The x-amz-version-id value is particularly useful for reconnaissance against versioned buckets, and ETag values can confirm the presence of known files by hash comparison.

Root Cause

The root cause is an ordering flaw in request handling. Precondition evaluation ran ahead of the authorization check that determines whether anonymous callers may access the requested object. The fix reorders the checks so that anonymous access validation completes before any metadata-derived response is generated.

Attack Vector

Exploitation requires only network reachability to the MinIO HTTP endpoint. An attacker issues an anonymous GET /bucket/object request with an If-Modified-Since header set to a distant past date. Buckets and object names can be brute-forced or guessed. Differential responses reveal whether the object exists and expose the metadata fields listed above.

bash

# Reference patch metadata from the upstream fix
# Source: https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272
# Commit: e0fe7cc391724fc5baa85b45508f425020fe4272
# Pull Request: #19810 - fix: information disclosure bug in preconditions GET
# Fixed release: RELEASE.2024-05-27T19-17-46Z

See the MinIO Pull Request #19810 and GitHub Security Advisory GHSA-95fr-cm4m-q5p9 for the complete code change.

Detection Methods for CVE-2024-36107

Indicators of Compromise

Anonymous HTTP GET requests to MinIO endpoints containing If-Modified-Since or If-Unmodified-Since headers with no accompanying AWS Signature Version 4 authorization.
High volumes of 304 Not Modified or 412 Precondition Failed responses from a single source against varying object keys.
Sequential or dictionary-style object name enumeration in MinIO access logs.

Detection Strategies

Parse MinIO audit logs for anonymous requests that carry conditional headers and correlate on source IP and request rate.
Alert on repeated requests targeting non-existent objects across many buckets from unauthenticated sessions.
Baseline expected anonymous traffic patterns for public buckets and flag deviations against private buckets.

Monitoring Recommendations

Forward MinIO server and audit logs to a centralized log platform with retention sufficient for reconnaissance investigations.
Deploy web application firewall or reverse proxy rules that inspect S3-style requests to MinIO for anomalous header usage.
Track MinIO release versions across the fleet and alert when hosts run builds older than RELEASE.2024-05-27T19-17-46Z.

How to Mitigate CVE-2024-36107

Immediate Actions Required

Upgrade all MinIO servers to RELEASE.2024-05-27T19-17-46Z or later without delay.
Inventory MinIO deployments including containerized and embedded instances and confirm the running version.
Review bucket policies and remove unintended anonymous access grants on sensitive buckets.

Patch Information

The vulnerability is fixed in MinIO commit e0fe7cc391724fc5baa85b45508f425020fe4272, delivered in release RELEASE.2024-05-27T19-17-46Z. The patch reorders precondition evaluation so anonymous access authorization runs first. See the MinIO Commit e0fe7cc and GitHub Security Advisory GHSA-95fr-cm4m-q5p9 for details.

Workarounds

No official workaround exists per the vendor advisory; upgrading is required.
As a defense-in-depth measure, restrict network exposure of MinIO endpoints to trusted networks or authenticated reverse proxies.
Audit and remove anonymous read policies on buckets that do not require public access.