cvelistv5 - cve-2024-35194

CVE-2024-35194 (GCVE-0-2024-35194)

Vulnerability from cvelistv5 – Published: 2024-05-20 20:44 – Updated: 2024-08-02 03:07

Title

Stacklok Minder vulnerable to denial of service from maliciously crafted templates

Summary

Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

URL

Tags

	https://github.com/stacklok/minder/security/advis…	x_refsource_CONFIRM
	https://github.com/stacklok/minder/commit/fe321d3…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	stacklok	minder	Affected: < 0.0.50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T14:26:28.547364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:46.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:07:46.859Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27"
          },
          {
            "name": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "minder",
          "vendor": "stacklok",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.50"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-20T20:44:10.562Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27"
        },
        {
          "name": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892"
        }
      ],
      "source": {
        "advisory": "GHSA-crgc-2583-rw27",
        "discovery": "UNKNOWN"
      },
      "title": "Stacklok Minder vulnerable to denial of service from maliciously crafted templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-35194",
    "datePublished": "2024-05-20T20:44:10.562Z",
    "dateReserved": "2024-05-10T14:24:24.342Z",
    "dateUpdated": "2024-08-02T03:07:46.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.\"}, {\"lang\": \"es\", \"value\": \"Minder es una plataforma de seguridad de la cadena de suministro de software. Antes de la versi\\u00f3n 0.0.50, el motor Minder es susceptible a una denegaci\\u00f3n de servicio por agotamiento de la memoria que puede desencadenarse a partir de plantillas creadas con fines malintencionados. El motor Minder utiliza plantillas para generar cadenas para diversos casos de uso, como URL, mensajes para solicitudes de extracci\\u00f3n y descripciones para avisos. En algunos casos, el usuario puede controlar tanto la plantilla como sus par\\u00e1metros y, en un subconjunto de estos casos, Minder lee la plantilla generada por completo en la memoria. Cuando las plantillas de Minders cumplen ambas condiciones, un atacante puede generar plantillas lo suficientemente grandes como para que Minder agote la memoria y falle. Esta vulnerabilidad se solucion\\u00f3 en 0.0.50.\"}]",
      "id": "CVE-2024-35194",
      "lastModified": "2024-11-21T09:19:54.380",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 3.6}]}",
      "published": "2024-05-20T21:15:09.773",
      "references": "[{\"url\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35194\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-05-20T21:15:09.773\",\"lastModified\":\"2024-11-21T09:19:54.380\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.\"},{\"lang\":\"es\",\"value\":\"Minder es una plataforma de seguridad de la cadena de suministro de software. Antes de la versi\u00f3n 0.0.50, el motor Minder es susceptible a una denegaci\u00f3n de servicio por agotamiento de la memoria que puede desencadenarse a partir de plantillas creadas con fines malintencionados. El motor Minder utiliza plantillas para generar cadenas para diversos casos de uso, como URL, mensajes para solicitudes de extracci\u00f3n y descripciones para avisos. En algunos casos, el usuario puede controlar tanto la plantilla como sus par\u00e1metros y, en un subconjunto de estos casos, Minder lee la plantilla generada por completo en la memoria. Cuando las plantillas de Minders cumplen ambas condiciones, un atacante puede generar plantillas lo suficientemente grandes como para que Minder agote la memoria y falle. Esta vulnerabilidad se solucion\u00f3 en 0.0.50.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"name\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"name\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:07:46.859Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35194\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T14:26:28.547364Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-21T14:26:51.319Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Stacklok Minder vulnerable to denial of service from maliciously crafted templates\", \"source\": {\"advisory\": \"GHSA-crgc-2583-rw27\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"stacklok\", \"product\": \"minder\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.0.50\"}]}], \"references\": [{\"url\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"name\": \"https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"name\": \"https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-20T20:44:10.562Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35194\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T03:07:46.859Z\", \"dateReserved\": \"2024-05-10T14:24:24.342Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-05-20T20:44:10.562Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-CRGC-2583-RW27

Vulnerability from github – Published: 2024-05-20 20:43 – Updated: 2024-05-20 22:07

Summary

Stacklok Minder vulnerable to denial of service from maliciously crafted templates

Details

Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates.

Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash.

One of these places is the REST ingester:

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L115-L123

With control over both endpoint and retp on the following line:

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121

… an attacker can make Minder generate a large template that Minder reads into memory on the following line by invoking endpoint.String():

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L131

Consider this example:

package main

import (
        "fmt"
        "html/template"
        "os"
)

type EndpointTemplateParams struct {
        // Params are the parameters to be used in the template
        Params map[string]any
}

func main() {
        retp := &EndpointTemplateParams{
                Params: map[string]any{
                        "params": make([]string, 10),
                },
        }
        fmt.Println(retp)
        const templ = `
        {{range $idx, $e := .Params.params}}
    loooooooooooooooooooooooooooooooong-string-{{$idx}}
{{end}}
        {{range $idx, $e := .Params.params}}
    loooooooooooooooooooooooooooooooong-string-{{$idx}}
{{end}}
        {{range $idx, $e := .Params.params}}
    loooooooooooooooooooooooooooooooong-string-{{$idx}}
{{end}}`
        tmpl := template.Must(template.New("").Parse(templ))
        if err := tmpl.Execute(os.Stdout, retp); err != nil {
                panic(err)
        }
}

This example imitates the behavior on these lines:

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L115-L123

Running this example generates the following template:

    loooooooooooooooooooooooooooooooong-string-0

    loooooooooooooooooooooooooooooooong-string-1

    loooooooooooooooooooooooooooooooong-string-2

    loooooooooooooooooooooooooooooooong-string-3

    loooooooooooooooooooooooooooooooong-string-4

    loooooooooooooooooooooooooooooooong-string-5

    loooooooooooooooooooooooooooooooong-string-6

    loooooooooooooooooooooooooooooooong-string-7

    loooooooooooooooooooooooooooooooong-string-8

    loooooooooooooooooooooooooooooooong-string-9


    loooooooooooooooooooooooooooooooong-string-0

    loooooooooooooooooooooooooooooooong-string-1

    loooooooooooooooooooooooooooooooong-string-2

    loooooooooooooooooooooooooooooooong-string-3

    loooooooooooooooooooooooooooooooong-string-4

    loooooooooooooooooooooooooooooooong-string-5

    loooooooooooooooooooooooooooooooong-string-6

    loooooooooooooooooooooooooooooooong-string-7

    loooooooooooooooooooooooooooooooong-string-8

    loooooooooooooooooooooooooooooooong-string-9


    loooooooooooooooooooooooooooooooong-string-0

    loooooooooooooooooooooooooooooooong-string-1

    loooooooooooooooooooooooooooooooong-string-2

    loooooooooooooooooooooooooooooooong-string-3

    loooooooooooooooooooooooooooooooong-string-4

    loooooooooooooooooooooooooooooooong-string-5

    loooooooooooooooooooooooooooooooong-string-6

    loooooooooooooooooooooooooooooooong-string-7

    loooooooooooooooooooooooooooooooong-string-8

    loooooooooooooooooooooooooooooooong-string-9

A malicious user can call the loop more times, increase the loop count and/or make the repeated long string longer to make the size of the template bigger.

A sufficiently large template will consume a lot of memory on this line which will exhaust memory on the machine and crash the Minder server:

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121

Minder should enforce a limit to generated templates before reading them into memory.

The following templates are believed to be vulnerable:

https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121

https://github.com/stacklok/minder/blob/e7f9914de9af5a69e3e6fe2bdfaaf22e62be42c0/internal/engine/actions/remediate/pull_request/pull_request.go#L199

https://github.com/stacklok/minder/blob/e7f9914de9af5a69e3e6fe2bdfaaf22e62be42c0/internal/engine/actions/remediate/pull_request/pull_request.go#L510

Minder has a few other templates especially in its engine which needs reviewing too. As a default, all templates should be limited in size before Minder reads them into memory.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/stacklok/minder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-20T20:43:54Z",
    "nvd_published_at": "2024-05-20T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates.\n\nMinder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash.\n\nOne of these places is the REST ingester:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L115-L123\n\nWith control over both endpoint and `retp` on the following line:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121\n\n\u2026 an attacker can make Minder generate a large template that Minder reads into memory on the following line by invoking `endpoint.String()`:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L131\n\nConsider this example:\n\n```go\npackage main\n\nimport (\n        \"fmt\"\n        \"html/template\"\n        \"os\"\n)\n\ntype EndpointTemplateParams struct {\n        // Params are the parameters to be used in the template\n        Params map[string]any\n}\n\nfunc main() {\n        retp := \u0026EndpointTemplateParams{\n                Params: map[string]any{\n                        \"params\": make([]string, 10),\n                },\n        }\n        fmt.Println(retp)\n        const templ = `\n        {{range $idx, $e := .Params.params}}\n    loooooooooooooooooooooooooooooooong-string-{{$idx}}\n{{end}}\n        {{range $idx, $e := .Params.params}}\n    loooooooooooooooooooooooooooooooong-string-{{$idx}}\n{{end}}\n        {{range $idx, $e := .Params.params}}\n    loooooooooooooooooooooooooooooooong-string-{{$idx}}\n{{end}}`\n        tmpl := template.Must(template.New(\"\").Parse(templ))\n        if err := tmpl.Execute(os.Stdout, retp); err != nil {\n                panic(err)\n        }\n}\n\n```\n\nThis example imitates the behavior on these lines:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L115-L123\n\nRunning this example generates the following template:\n\n```\n    loooooooooooooooooooooooooooooooong-string-0\n\n    loooooooooooooooooooooooooooooooong-string-1\n\n    loooooooooooooooooooooooooooooooong-string-2\n\n    loooooooooooooooooooooooooooooooong-string-3\n\n    loooooooooooooooooooooooooooooooong-string-4\n\n    loooooooooooooooooooooooooooooooong-string-5\n\n    loooooooooooooooooooooooooooooooong-string-6\n\n    loooooooooooooooooooooooooooooooong-string-7\n\n    loooooooooooooooooooooooooooooooong-string-8\n\n    loooooooooooooooooooooooooooooooong-string-9\n\n\n    loooooooooooooooooooooooooooooooong-string-0\n\n    loooooooooooooooooooooooooooooooong-string-1\n\n    loooooooooooooooooooooooooooooooong-string-2\n\n    loooooooooooooooooooooooooooooooong-string-3\n\n    loooooooooooooooooooooooooooooooong-string-4\n\n    loooooooooooooooooooooooooooooooong-string-5\n\n    loooooooooooooooooooooooooooooooong-string-6\n\n    loooooooooooooooooooooooooooooooong-string-7\n\n    loooooooooooooooooooooooooooooooong-string-8\n\n    loooooooooooooooooooooooooooooooong-string-9\n\n\n    loooooooooooooooooooooooooooooooong-string-0\n\n    loooooooooooooooooooooooooooooooong-string-1\n\n    loooooooooooooooooooooooooooooooong-string-2\n\n    loooooooooooooooooooooooooooooooong-string-3\n\n    loooooooooooooooooooooooooooooooong-string-4\n\n    loooooooooooooooooooooooooooooooong-string-5\n\n    loooooooooooooooooooooooooooooooong-string-6\n\n    loooooooooooooooooooooooooooooooong-string-7\n\n    loooooooooooooooooooooooooooooooong-string-8\n\n    loooooooooooooooooooooooooooooooong-string-9\n```\n\nA malicious user can call the loop more times, increase the loop count and/or make the repeated long string longer to make the size of the template bigger.\n\nA sufficiently large template will consume a lot of memory on this line which will exhaust memory on the machine and crash the Minder server:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121\n\nMinder should enforce a limit to generated templates before reading them into memory.\n\nThe following templates are believed to be vulnerable:\n\nhttps://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/engine/ingester/rest/rest.go#L121\n\nhttps://github.com/stacklok/minder/blob/e7f9914de9af5a69e3e6fe2bdfaaf22e62be42c0/internal/engine/actions/remediate/pull_request/pull_request.go#L199\n\nhttps://github.com/stacklok/minder/blob/e7f9914de9af5a69e3e6fe2bdfaaf22e62be42c0/internal/engine/actions/remediate/pull_request/pull_request.go#L510\n\nMinder has a few other templates especially in its engine which needs reviewing too. As a default, all templates should be limited in size before Minder reads them into memory.\n",
  "id": "GHSA-crgc-2583-rw27",
  "modified": "2024-05-20T22:07:25Z",
  "published": "2024-05-20T20:43:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stacklok/minder"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Stacklok Minder vulnerable to denial of service from maliciously crafted templates"
}

FKIE_CVE-2024-35194

Vulnerability from fkie_nvd - Published: 2024-05-20 21:15 - Updated: 2024-11-21 09:19

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892
	security-advisories@github.com	https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50."
    },
    {
      "lang": "es",
      "value": "Minder es una plataforma de seguridad de la cadena de suministro de software. Antes de la versi\u00f3n 0.0.50, el motor Minder es susceptible a una denegaci\u00f3n de servicio por agotamiento de la memoria que puede desencadenarse a partir de plantillas creadas con fines malintencionados. El motor Minder utiliza plantillas para generar cadenas para diversos casos de uso, como URL, mensajes para solicitudes de extracci\u00f3n y descripciones para avisos. En algunos casos, el usuario puede controlar tanto la plantilla como sus par\u00e1metros y, en un subconjunto de estos casos, Minder lee la plantilla generada por completo en la memoria. Cuando las plantillas de Minders cumplen ambas condiciones, un atacante puede generar plantillas lo suficientemente grandes como para que Minder agote la memoria y falle. Esta vulnerabilidad se solucion\u00f3 en 0.0.50."
    }
  ],
  "id": "CVE-2024-35194",
  "lastModified": "2024-11-21T09:19:54.380",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-20T21:15:09.773",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-35194 (GCVE-0-2024-35194)

GHSA-CRGC-2583-RW27

FKIE_CVE-2024-35194

Tags

Sightings

Nomenclature