MinIO Security Lab

What it is

A reproduction environment for a defensive security review of MinIO pinned to commit 7aac2a2c5b7c882e68c1ce017d8256be2feea27f (≈ RELEASE.2025-10-15 + 11 commits). Everything runs in Docker containers — no local minio/mc install. Each finding (F-01…F-16) ships an ANALYSIS.md (root cause, data-flow trace, suggested fix) plus a repro.sh that prints a VULNERABLE if: line stating the expected pass/fail signal.

How it works

Findings carry one of two verification levels. Live means the pass/fail check was reproduced against the running server by a script in pocs/. review means it was confirmed only by independent code review (cross-vendor OpenAI/codex plus a from-raw verifier) and has an exact test written in analysis/FINDINGS.md but is not scripted here — some need a Go client or a specific multi-service setup. The methodology is a generate → judge → independent-verify pipeline over multi-altitude source review (project → file → function).

Preconditions

Docker and python3 are required. The OIDC check additionally needs pip install cryptography PyJWT. Go 1.24+ is only needed to build the exact-commit binary. Findings depend on specific lab topologies: F-01 (tag deletion) needs the two-node replication setup; F-03 (OIDC cross-provider) needs the dual-OIDC setup.

What to do

Bring up the lab in order, then run the per-finding scripts:

. setup/env.sh                       # endpoints, credentials, mc helper (source it)
bash setup/00-build-head.sh          # optional: exact-commit binary -> /tmp/minio-head-bin
bash setup/01-single-node.sh         # MinIO on :9000 (F-02,06,08,10,11,12,14,15,16)
bash setup/04-fixtures.sh            # tenants + low-priv user + positive control
bash setup/02-two-node-replication.sh   # nodes A:19000 / B:19001 (F-01)
bash setup/03-dual-oidc.sh               # two mock OIDC providers on node A (F-03)

Then, for example:

bash pocs/F-02_svcacct-key-traversal/repro.sh
bash pocs/F-06_serverupdate-ssrf/repro.sh
bash pocs/F-01_tag-deletion/repro.sh            # needs setup/02
bash pocs/F-03_oidc-cross-provider/repro.sh     # needs setup/03

Read analysis/REPORT.md for coverage, the set-aside list, and remaining work; analysis/FINDINGS.md for the full register including rejected items; analysis/entrypoint-manifest.md for the route map. Tooling lives in harness/: s3sig.py (stdlib SigV4 signer that lets you attach extra headers post-signing) and mock_idp.py (dual mock OIDC provider + RS256 token minter).

Caveats

This is a review of an unreleased pinned commit, not a released version — findings may not map cleanly to a shipping release. Not all findings are scripted; the review-only ones require you to build the test yourself from FINDINGS.md. Of ~90 candidates, roughly 55 were set aside as intended behavior, already-patched, or false positives — four specifically ruled out by live testing after passing static review, a reminder that static confirmation alone over-reports here.