-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.minio:minio | maven | < 8.6.0 | 8.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is caused by the default behavior of the org.simpleframework.xml.core.Persister class, which is used for XML serialization and deserialization in minio-java. This class, by default, substitutes placeholders in the format ${...} with the values of system properties or environment variables. An attacker can exploit this by crafting a malicious XML payload that includes these placeholders. When a vulnerable version of the minio-java application processes this XML using the io.minio.Xml class, the placeholders are replaced with sensitive information from the server environment, which can then be exfiltrated.
The patch, identified in commit f7a98d06b25e5464bdd4811b044e25ff9101d37f, addresses this by creating a noopFilter that prevents any substitution from occurring. This filter is then applied to the Persister instance in all relevant methods within the io.minio.Xml class: marshal, unmarshal, and validate. These functions are the direct entry points for the vulnerability. The unmarshal and validate functions are vulnerable to malicious input from external sources, while marshal is patched to prevent scenarios where application data containing placeholders could be inadvertently exposed.
JavaJava