github - ghsa-q6h8-4j2v-pjg4

GHSA-Q6H8-4J2V-PJG4

Vulnerability from github – Published: 2024-02-26 22:15 – Updated: 2025-02-05 21:19

Summary

Minder trusts client-provided mapping from repo name to upstream ID

Details

Summary

When using a modified client or the grpc interface directly, the RegisterRepository call accepts both the repository owner / repo and the repo_id. Furthermore, these two are not checked for matching before registering webhooks and data in the database.

Details

It is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch.

PoC

With an RPC like the following text proto:

context {
  ...
}
repository {
  owner: "Stacklok-Demo-Org"
  repo: "python-app"
  # repo_id is defaulted to 0
}

I was able to produce the following minder output:

+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+
|                  ID                  |               PROJECT                | PROVIDER | UPSTREAM ID |       OWNER       |    NAME    |
+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+
| da3acba4-ef66-4d9b-b41e-250869107fd5 | f9f4aef0-74af-4909-a0c3-0e8ac7fbc38d | github   |           0 | Stacklok-Demo-Org | python-app |
+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+
| 7cf8f7b8-b19b-40dd-a96b-b88bb1ef5563 | f9f4aef0-74af-4909-a0c3-0e8ac7fbc38d | github   |   762029128 | evankanderson     | bad-python |
+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+

$ gh api repos/Stacklok-Demo-Org/python-app | jq .id                  
762029128

I've registered bad-python with the ID of python-app, and python-app with an ID of 0.

Impact

This appears to primarily be a potential denial-of-service vulnerability.

Severity ?

4.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/stacklok/minder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.20240226.1425"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27093"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-26T22:15:45Z",
    "nvd_published_at": "2024-02-26T22:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen using a modified client or the grpc interface directly, the `RegisterRepository` call accepts _both_ the repository owner / repo **and** the repo_id.  Furthermore, these two are not checked for matching before registering webhooks and data in the database.\n\n### Details\n\nIt is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch.\n\n### PoC\n\nWith an RPC like the following text proto:\n\n```\ncontext {\n  ...\n}\nrepository {\n  owner: \"Stacklok-Demo-Org\"\n  repo: \"python-app\"\n  # repo_id is defaulted to 0\n}\n```\n\nI was able to produce the following `minder` output:\n\n```\n+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+\n|                  ID                  |               PROJECT                | PROVIDER | UPSTREAM ID |       OWNER       |    NAME    |\n+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+\n| da3acba4-ef66-4d9b-b41e-250869107fd5 | f9f4aef0-74af-4909-a0c3-0e8ac7fbc38d | github   |           0 | Stacklok-Demo-Org | python-app |\n+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+\n| 7cf8f7b8-b19b-40dd-a96b-b88bb1ef5563 | f9f4aef0-74af-4909-a0c3-0e8ac7fbc38d | github   |   762029128 | evankanderson     | bad-python |\n+--------------------------------------+--------------------------------------+----------+-------------+-------------------+------------+\n```\n\n```\n$ gh api repos/Stacklok-Demo-Org/python-app | jq .id                  \n762029128\n```\n\nI\u0027ve registered bad-python with the ID of python-app, and python-app with an ID of 0.\n\n### Impact\n\nThis appears to primarily be a potential denial-of-service vulnerability.",
  "id": "GHSA-q6h8-4j2v-pjg4",
  "modified": "2025-02-05T21:19:41Z",
  "published": "2024-02-26T22:15:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27093"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stacklok/minder"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-2582"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Minder trusts client-provided mapping from repo name to upstream ID"
}

CVE-2024-27093 (GCVE-0-2024-27093)

Vulnerability from cvelistv5 – Published: 2024-02-26 21:57 – Updated: 2024-08-27 19:43

Title

Minder trusts client-provided mapping from repo name to upstream ID

Summary

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability. This vulnerability is patched in version 0.20240226.1425+ref.53868a8.

Severity ?

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/stacklok/minder/security/advis…	x_refsource_CONFIRM
	https://github.com/stacklok/minder/commit/53868a8…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	stacklok	minder	Affected: < 0.20240226.1425+ref.53868a8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:58.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4"
          },
          {
            "name": "https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:stacklok:minder:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "minder",
            "vendor": "stacklok",
            "versions": [
              {
                "lessThan": "0.20240226.1425\\+ref.53868a8",
                "status": "affected",
                "version": "0",
                "versionType": "git"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27093",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T18:24:55.540745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-27T19:43:28.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "minder",
          "vendor": "stacklok",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.20240226.1425+ref.53868a8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability.  This vulnerability is patched in version 0.20240226.1425+ref.53868a8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-26T21:57:25.101Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4"
        },
        {
          "name": "https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d"
        }
      ],
      "source": {
        "advisory": "GHSA-q6h8-4j2v-pjg4",
        "discovery": "UNKNOWN"
      },
      "title": "Minder trusts client-provided mapping from repo name to upstream ID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-27093",
    "datePublished": "2024-02-26T21:57:25.101Z",
    "dateReserved": "2024-02-19T14:43:05.993Z",
    "dateUpdated": "2024-08-27T19:43:28.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-Q6H8-4J2V-PJG4

Summary

Details

PoC

Impact

CVE-2024-27093 (GCVE-0-2024-27093)

Tags

Sightings

Nomenclature