fix: CVE-2026-34204 block replication metadata injection

Close the replication-header trust flaw that allowed ordinary PutObject and CopyObject requests to smuggle X-Minio-Replication-* headers into X-Minio-Internal-* SSE metadata and write objects into an unreadable state. Stop accepting replication-only metadata in the default extraction path, restore it only after a trusted replication write has passed ReplicateObjectAction, and tighten CopyObject by sanitizing replication-only request headers before metadata, precondition, and SSE-C source handling consume them. Also gate replica status writes on the same trusted replication path and restore replication SSE metadata in multipart and snowball upload flows so legitimate replication continues to work. Add focused regression coverage for untrusted PUT and COPY header poisoning at the handler layer, plus helper tests for trusted vs untrusted metadata extraction and CopyObject header sanitization. Validate the new tests against both the patched tree and the vulnerable HEAD baseline, and confirm with live server before/after runs that malicious PUT/COPY requests no longer turn objects unreadable. Co-authored-by: Codex <codex@openai.com> Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-25 15:06:17 +03:00 · 2026-04-15 18:36:49 +08:00
parent 3b950f8fa8
commit 56fa63bfd1
5 changed files with 361 additions and 9 deletions
@@ -42,6 +42,7 @@ import (

 	"github.com/dustin/go-humanize"
 	"github.com/minio/minio/internal/auth"
+	"github.com/minio/minio/internal/crypto"
 	"github.com/minio/minio/internal/hash/sha256"
 	xhttp "github.com/minio/minio/internal/http"
 	ioutilx "github.com/minio/minio/internal/ioutil"
@@ -60,6 +61,47 @@ const (
 	MissingUploadID
 )

+func replicationSSEPoisonHeaders() map[string]string {
+	return map[string]string{
+		"X-Minio-Replication-Server-Side-Encryption-Sealed-Key":     base64.StdEncoding.EncodeToString(make([]byte, 64)),
+		"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm": crypto.SealAlgorithm,
+		"X-Minio-Replication-Server-Side-Encryption-Iv":             base64.StdEncoding.EncodeToString(make([]byte, 32)),
+	}
+}
+
+func assertObjectMetadataKeysAbsent(t *testing.T, metadata map[string]string, keys ...string) {
+	t.Helper()
+	for _, key := range keys {
+		if got, ok := metadata[key]; ok {
+			t.Fatalf("expected metadata %q to be absent, got %q", key, got)
+		}
+	}
+}
+
+func assertObjectMetadataValueNotEqual(t *testing.T, metadata map[string]string, key, unexpected string) {
+	t.Helper()
+	if got := metadata[key]; got == unexpected {
+		t.Fatalf("expected metadata %q to differ from %q", key, unexpected)
+	}
+}
+
+func assertObjectContents(t *testing.T, obj ObjectLayer, bucketName, objectName string, expected []byte) {
+	t.Helper()
+	reader, err := obj.GetObjectNInfo(context.Background(), bucketName, objectName, nil, nil, ObjectOptions{})
+	if err != nil {
+		t.Fatalf("failed to fetch object %s/%s: %v", bucketName, objectName, err)
+	}
+	defer reader.Close()
+
+	got, err := io.ReadAll(reader)
+	if err != nil {
+		t.Fatalf("failed to read object %s/%s: %v", bucketName, objectName, err)
+	}
+	if !bytes.Equal(got, expected) {
+		t.Fatalf("unexpected object contents: got %d bytes, expected %d bytes", len(got), len(expected))
+	}
+}
+
 // Wrapper for calling HeadObject API handler tests for both Erasure multiple disks and FS single drive setup.
 func TestAPIHeadObjectHandler(t *testing.T) {
 	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: testAPIHeadObjectHandler, endpoints: []string{"HeadObject"}})
@@ -1819,6 +1861,53 @@ func testAPICopyObjectPartHandlerSanity(obj ObjectLayer, instanceType, bucketNam
 	}
 }

+func TestAPIPutObjectReplicationHeaderPoisoning(t *testing.T) {
+	defer DetectTestLeak(t)()
+	ExecExtendedObjectLayerAPITest(t, testAPIPutObjectReplicationHeaderPoisoning, []string{"PutObject"})
+}
+
+func testAPIPutObjectReplicationHeaderPoisoning(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
+	credentials auth.Credentials, t *testing.T,
+) {
+	objectName := "replication-header-poison-put"
+	payload := []byte("replication-header-poison-put-payload")
+	headers := replicationSSEPoisonHeaders()
+
+	req, err := newTestSignedRequestV4(
+		http.MethodPut,
+		getPutObjectURL("", bucketName, objectName),
+		int64(len(payload)),
+		bytes.NewReader(payload),
+		credentials.AccessKey,
+		credentials.SecretKey,
+		headers,
+	)
+	if err != nil {
+		t.Fatalf("%s: failed to create signed put request: %v", instanceType, err)
+	}
+
+	rec := httptest.NewRecorder()
+	apiRouter.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("%s: expected put to succeed, got %d", instanceType, rec.Code)
+	}
+
+	objInfo, err := obj.GetObjectInfo(context.Background(), bucketName, objectName, ObjectOptions{})
+	if err != nil {
+		t.Fatalf("%s: failed to fetch object info: %v", instanceType, err)
+	}
+
+	assertObjectMetadataValueNotEqual(t, objInfo.UserDefined,
+		crypto.MetaSealedKeySSEC,
+		headers["X-Minio-Replication-Server-Side-Encryption-Sealed-Key"],
+	)
+	assertObjectMetadataValueNotEqual(t, objInfo.UserDefined,
+		crypto.MetaIV,
+		headers["X-Minio-Replication-Server-Side-Encryption-Iv"],
+	)
+	assertObjectContents(t, obj, bucketName, objectName, payload)
+}
+
 // Wrapper for calling Copy Object Part API handler tests for both Erasure multiple disks and single node setup.
 func TestAPICopyObjectPartHandler(t *testing.T) {
 	defer DetectTestLeak(t)()
@@ -2860,6 +2949,74 @@ func testAPINewMultipartHandlerParallel(obj ObjectLayer, instanceType, bucketNam
 	}
 }

+func TestAPICopyObjectReplicationHeaderPoisoning(t *testing.T) {
+	defer DetectTestLeak(t)()
+	ExecExtendedObjectLayerAPITest(t, testAPICopyObjectReplicationHeaderPoisoning, []string{"CopyObject", "PutObject"})
+}
+
+func testAPICopyObjectReplicationHeaderPoisoning(obj ObjectLayer, instanceType, bucketName string, apiRouter http.Handler,
+	credentials auth.Credentials, t *testing.T,
+) {
+	srcObject := "replication-header-poison-copy-src"
+	dstObject := "replication-header-poison-copy-dst"
+	payload := []byte("replication-header-poison-copy-payload")
+
+	if _, err := obj.PutObject(
+		context.Background(),
+		bucketName,
+		srcObject,
+		mustGetPutObjReader(t, bytes.NewReader(payload), int64(len(payload)), "", ""),
+		ObjectOptions{},
+	); err != nil {
+		t.Fatalf("%s: failed to create source object: %v", instanceType, err)
+	}
+
+	headers := replicationSSEPoisonHeaders()
+	headers[xhttp.AmzCopySource] = url.QueryEscape(SlashSeparator + bucketName + SlashSeparator + srcObject)
+	headers[xhttp.AmzMetadataDirective] = replaceDirective
+	headers[xhttp.AmzBucketReplicationStatus] = "PENDING"
+	headers["Content-Type"] = "application/octet-stream"
+
+	req, err := newTestSignedRequestV4(
+		http.MethodPut,
+		getCopyObjectURL("", bucketName, dstObject),
+		0,
+		nil,
+		credentials.AccessKey,
+		credentials.SecretKey,
+		headers,
+	)
+	if err != nil {
+		t.Fatalf("%s: failed to create signed copy request: %v", instanceType, err)
+	}
+
+	rec := httptest.NewRecorder()
+	apiRouter.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("%s: expected copy to succeed, got %d", instanceType, rec.Code)
+	}
+
+	objInfo, err := obj.GetObjectInfo(context.Background(), bucketName, dstObject, ObjectOptions{})
+	if err != nil {
+		t.Fatalf("%s: failed to fetch copied object info: %v", instanceType, err)
+	}
+
+	assertObjectMetadataValueNotEqual(t, objInfo.UserDefined,
+		crypto.MetaSealedKeySSEC,
+		headers["X-Minio-Replication-Server-Side-Encryption-Sealed-Key"],
+	)
+	assertObjectMetadataValueNotEqual(t, objInfo.UserDefined,
+		crypto.MetaIV,
+		headers["X-Minio-Replication-Server-Side-Encryption-Iv"],
+	)
+	assertObjectMetadataKeysAbsent(t, objInfo.UserDefined,
+		xhttp.AmzBucketReplicationStatus,
+		ReservedMetadataPrefixLower+ReplicaStatus,
+		ReservedMetadataPrefixLower+ReplicaTimestamp,
+	)
+	assertObjectContents(t, obj, bucketName, dstObject, payload)
+}
+
 // The UploadID from the response body is parsed and its existence is asserted with an attempt to ListParts using it.
 func TestAPICompleteMultipartHandler(t *testing.T) {
 	defer DetectTestLeak(t)()