MinIO SigV4 header validation flaw enables presigned PUT confused-deputy reads

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.

• MinIO: affected through Git commit 7aac2a2, according to the supplied Git version boundary. The record does not identify a specific upstream release containing the fix.
• pgsty/silo: versions before commit 1233254 are affected. Commit 1233254 is the referenced fix for rejecting unsigned x-amz-* headers; a release-number mapping for that commit is not established.
• The minio/minio GitHub repository was archived in April 2026. Status therefore needs to be checked against the actual deployed build or fork, not inferred from the product name alone.

The flaw is incomplete verification of SigV4 signature coverage. extractSignedHeaders() in cmd/signature-v4-utils.go iterates over the client-provided X-Amz-SignedHeaders list, but does not compare that list with every x-amz-* header that actually arrived at the server. An x-amz-* header can therefore be present without being included in the canonical request and without being rejected.

cmd/api-router.go selects the CopyObject path based only on the presence of x-amz-copy-source. As a result, a presigned PUT URL scoped to one destination object can be combined with that unsigned header to make the server perform a server-side copy under the signer's authority. A narrow write grant can consequently become access to objects readable by the signing key. The pgsty/silo fix adds unsigned-header checks to both presigned-signature and Authorization-header verification; X-Amz-Content-Sha256 and X-Amz-Signature-Age receive separate treatment as verification-specific exceptions. The available evidence does not establish whether a specific upstream MinIO release contains the fix.

The flaw is reachable over the network when an attacker possesses a valid presigned PUT URL. The key condition is that the URL targets one writable object while its signing key can read other objects or buckets.

• The record describes low attack complexity and no user interaction after the URL has been issued.
• Exploitation does not require changing the signature or generating a new URL; the attacker adds x-amz-copy-source outside the signed-header set.
• The resulting operation executes with the signer's permissions rather than with a separate permission set belonging to the requester.
• The available record does not establish observed exploitation or a public exploit. That absence of information is not evidence that exploitation has not occurred.

The flaw allows a request that authenticates as a valid PUT to be routed as CopyObject when it contains x-amz-copy-source. The copy runs with the signer's permissions, so the signing key's read access determines the potential data exposure.

• Confidentiality: potentially high when the key can read multiple buckets or sensitive data.
• Integrity: may be affected because an attacker can create or overwrite a copy in the destination allowed by the presigned URL.
• Privilege boundary: permission to write one object can become permission to read other objects reachable by the signer.
• Availability: the available evidence does not indicate a direct availability impact.

Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied, indicating that MinIO's behavior differs from the reference service's header-coverage check. Actual scope still depends on the relevant policies, buckets, and signing key.

The flaw defeats the intended scope of presigned PUT URLs. A URL issued to upload one object can let its holder cause the server to copy data from other objects readable by the signing key.

• Data in multiple buckets or tenants may be exposed when the signing key has broad read access.
• Unexpected object copies may be created in the writable destination area, affecting stored data or downstream processing.
• The boundary between upload permission and read permission is weakened, particularly in applications that issue URLs to untrusted users or clients.
• Actual exposure depends on the signing key's read policy and whether the affected S3 endpoints are reachable by untrusted parties.

1. For pgsty/silo, deploy a build containing commit 1233254. The fix checks every x-amz-* request header and rejects headers absent from the signed-header set on both presigned-signature and Authorization-header verification paths.
2. For upstream MinIO, identify the exact deployed commit or build. The record confirms exposure through 7aac2a2 but does not provide a specific upstream fixed release, so an unverified newer version should not be assumed safe.
3. Until an affected deployment can be upgraded, revoke or expire outstanding presigned PUT URLs that may be exposed, especially URLs issued by signing keys with access to multiple buckets.
4. Reduce the signing principal's read permissions to the minimum required by each workflow. This is temporary risk reduction and does not replace the signature-validation fix.
5. Review objects created through presigned PUT workflows and unusual CopyObject activity to assess whether unexpected copies may have occurred.

Perform the following checks:

1. Inventory deployed MinIO and Silo servers, then compare each build with the affected MinIO boundary and the pgsty/silo fix commit 1233254.
2. Identify presigned PUT workflows where the signing principal can read more broadly than the destination object, especially when its read permissions span multiple buckets.
3. Review audit or request logs, where available, for CopyObject activity associated with presigned PUT workflows and requests containing x-amz-copy-source outside the signed-header set.
4. Review outstanding URLs and signing-key permissions. This assesses exposure and is not a confirmed indicator of compromise.

The absence of matching log records should not be treated as proof of safety, because the available evidence does not define a complete log format or a definitive indicator that would rule out exploitation.