Log in Start free

Vulnerability · Published Mar 6, 2024 · Assigned by GitHub_M

CVE-2024-27916`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

High 7.1

In plain English

A high-severity security flaw in minder from stacklok. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/stacklok/minder0.0.33GHSA-v627-69v2-xx37
Gogithub.com/stacklok/minder0.0.33GO-2024-2608

Affected products (as reported)

VendorProductVersions
stacklok minder < 0.0.33

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References