CVE-2025-31489
Published: 03 April 2025
Summary
CVE-2025-31489 is a high-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 19.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
MinIO, a high-performance object storage system, contains a flaw in its signature verification logic within the authorization component. The issue, tracked as CVE-2025-31489 and assigned CWE-347, allows an invalid signature to be accepted when uploading objects, provided the attacker already possesses an access key that has WRITE permissions on the target bucket along with knowledge of the bucket name. The vulnerability affects all prior releases and carries a CVSS 4.0 score of 8.7 due to its network-exploitable impact on data integrity.
An attacker who meets the prerequisite conditions can supply an arbitrary secret in place of a valid signature and thereby upload arbitrary objects to the bucket using simple tools such as curl. No other authentication material or special network position is required once the access key and bucket details are known, enabling straightforward tampering or injection of content into storage that the compromised key is authorized to modify.
The official fix is included in MinIO release 2025-04-03T14-56-28Z. The accompanying GitHub security advisory and pull request 21103 recommend immediate upgrade to the patched version for any deployment that exposes the S3-compatible API to untrusted clients or networks.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0485, indicating that exploitation interest increased after public disclosure and that the issue merits renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9731
Vulnerability details
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects…
more
given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires verification of digital signatures using organization-approved certificates before installation, directly preventing improper verification of cryptographic signatures.
Component authenticity commonly depends on cryptographic signatures; the control enforces proper verification of those signatures.
PKI certificates under an approved policy require cryptographic signature verification on issuance and validation.
Requires cryptographic signatures on authoritative data and support for verifying the chain of trust.
Mandates verification of cryptographic signatures (e.g., DNSSEC RRSIG) on resolution responses, addressing missing or bypassed signature checks.
Integrity tools commonly rely on cryptographic signatures whose improper validation this weakness covers.
Authenticity validation commonly relies on cryptographic signature or certificate checks that this control enforces.