fix: CVE-2026-34204 block replication metadata injection

Close the replication-header trust flaw that allowed ordinary PutObject and CopyObject requests to smuggle X-Minio-Replication-* headers into X-Minio-Internal-* SSE metadata and write objects into an unreadable state. Stop accepting replication-only metadata in the default extraction path, restore it only after a trusted replication write has passed ReplicateObjectAction, and tighten CopyObject by sanitizing replication-only request headers before metadata, precondition, and SSE-C source handling consume them. Also gate replica status writes on the same trusted replication path and restore replication SSE metadata in multipart and snowball upload flows so legitimate replication continues to work. Add focused regression coverage for untrusted PUT and COPY header poisoning at the handler layer, plus helper tests for trusted vs untrusted metadata extraction and CopyObject header sanitization. Validate the new tests against both the patched tree and the vulnerable HEAD baseline, and confirm with live server before/after runs that malicious PUT/COPY requests no longer turn objects unreadable. Co-authored-by: Codex <codex@openai.com> Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-19 20:20:25 +03:00 · 2026-04-15 18:36:49 +08:00
parent 3b950f8fa8
commit 56fa63bfd1
5 changed files with 361 additions and 9 deletions
@@ -24,11 +24,13 @@ import (
 	"io"
 	"net/http"
 	"net/textproto"
+	"net/url"
 	"os"
 	"reflect"
 	"testing"

 	"github.com/minio/minio/internal/config"
+	xhttp "github.com/minio/minio/internal/http"
 )

 // Tests validate bucket LocationConstraint.
@@ -152,6 +154,22 @@ func TestExtractMetadataHeaders(t *testing.T) {
 			},
 			shouldFail: false,
 		},
+		// Replication-only headers must not be accepted on ordinary requests.
+		{
+			header: http.Header{
+				"Content-Type": []string{"image/png"},
+				"X-Minio-Replication-Server-Side-Encryption-Sealed-Key":     []string{"sealed-key"},
+				"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm": []string{"DAREv2-HMAC-SHA256"},
+				"X-Minio-Replication-Server-Side-Encryption-Iv":             []string{"iv"},
+				"X-Minio-Replication-Encrypted-Multipart":                   []string{""},
+				"X-Minio-Replication-Actual-Object-Size":                    []string{"1"},
+				ReplicationSsecChecksumHeader:                               []string{"checksum"},
+			},
+			metadata: map[string]string{
+				"content-type": "image/png",
+			},
+			shouldFail: false,
+		},
 		// Empty header input returns empty metadata.
 		{
 			header:     nil,
@@ -176,6 +194,104 @@ func TestExtractMetadataHeaders(t *testing.T) {
 	}
 }

+func TestExtractReplicationMetadataHeaders(t *testing.T) {
+	header := http.Header{
+		"X-Minio-Replication-Server-Side-Encryption-Sealed-Key":     []string{"sealed-key"},
+		"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm": []string{"DAREv2-HMAC-SHA256"},
+		"X-Minio-Replication-Server-Side-Encryption-Iv":             []string{"iv"},
+		"X-Minio-Replication-Encrypted-Multipart":                   []string{""},
+		"X-Minio-Replication-Actual-Object-Size":                    []string{"1"},
+		ReplicationSsecChecksumHeader:                               []string{"checksum"},
+	}
+
+	metadata := make(map[string]string)
+	if err := extractReplicationMetadataFromMime(t.Context(), textproto.MIMEHeader(header), metadata); err != nil {
+		t.Fatalf("failed to extract replication metadata: %v", err)
+	}
+
+	expected := map[string]string{
+		"X-Minio-Internal-Server-Side-Encryption-Sealed-Key":     "sealed-key",
+		"X-Minio-Internal-Server-Side-Encryption-Seal-Algorithm": "DAREv2-HMAC-SHA256",
+		"X-Minio-Internal-Server-Side-Encryption-Iv":             "iv",
+		"X-Minio-Internal-Encrypted-Multipart":                   "",
+		"X-Minio-Internal-Actual-Object-Size":                    "1",
+		ReplicationSsecChecksumHeader:                            "checksum",
+	}
+
+	if !reflect.DeepEqual(metadata, expected) {
+		t.Fatalf("unexpected replication metadata: expected %#v, got %#v", expected, metadata)
+	}
+}
+
+func TestGetCopyObjectMetadataFromHeaderReplication(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPut, "http://localhost/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Form = make(url.Values)
+	req.Header.Set("X-Amz-Metadata-Directive", replaceDirective)
+	req.Header.Set("X-Minio-Replication-Server-Side-Encryption-Sealed-Key", "sealed-key")
+
+	metadata, err := getCpObjMetadataFromHeader(t.Context(), req, nil, false)
+	if err != nil {
+		t.Fatalf("copy metadata extraction failed: %v", err)
+	}
+	if _, ok := metadata["X-Minio-Internal-Server-Side-Encryption-Sealed-Key"]; ok {
+		t.Fatalf("unexpected replication metadata without validation: %#v", metadata)
+	}
+
+	metadata, err = getCpObjMetadataFromHeader(t.Context(), req, nil, true)
+	if err != nil {
+		t.Fatalf("copy metadata extraction with replication failed: %v", err)
+	}
+	if got := metadata["X-Minio-Internal-Server-Side-Encryption-Sealed-Key"]; got != "sealed-key" {
+		t.Fatalf("expected restored replication metadata, got %#v", metadata)
+	}
+}
+
+func TestCloneRequestWithoutCopyReplicationHeaders(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPut, "http://localhost/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set(xhttp.MinIOSourceReplicationRequest, "true")
+	req.Header.Set(xhttp.MinIOSourceETag, "etag")
+	req.Header.Set(xhttp.MinIOSourceMTime, "2026-04-15T10:00:00Z")
+	req.Header.Set(xhttp.MinIOSourceTaggingTimestamp, "2026-04-15T10:00:00Z")
+	req.Header.Set(xhttp.MinIOSourceObjectRetentionTimestamp, "2026-04-15T10:00:00Z")
+	req.Header.Set(xhttp.MinIOSourceObjectLegalHoldTimestamp, "2026-04-15T10:00:00Z")
+	req.Header.Set(xhttp.MinIOReplicationActualObjectSize, "123")
+	req.Header.Set(ReplicationSsecChecksumHeader, "checksum")
+	req.Header.Set("Content-Type", "application/octet-stream")
+
+	clone := cloneRequestWithoutCopyReplicationHeaders(req)
+	if clone == req {
+		t.Fatal("expected cloned request")
+	}
+
+	for _, header := range []string{
+		xhttp.MinIOSourceReplicationRequest,
+		xhttp.MinIOSourceETag,
+		xhttp.MinIOSourceMTime,
+		xhttp.MinIOSourceTaggingTimestamp,
+		xhttp.MinIOSourceObjectRetentionTimestamp,
+		xhttp.MinIOSourceObjectLegalHoldTimestamp,
+		xhttp.MinIOReplicationActualObjectSize,
+		ReplicationSsecChecksumHeader,
+	} {
+		if got := clone.Header.Get(header); got != "" {
+			t.Fatalf("expected %s to be stripped, got %q", header, got)
+		}
+		if got := req.Header.Get(header); got == "" {
+			t.Fatalf("expected original request to preserve %s", header)
+		}
+	}
+
+	if got := clone.Header.Get("Content-Type"); got != "application/octet-stream" {
+		t.Fatalf("expected non-replication headers to be preserved, got %q", got)
+	}
+}
+
 // Test getResource()
 func TestGetResource(t *testing.T) {
 	testCases := []struct {