PT-2024-22133 · Minder · Minder

Dmjb · Published 2024-03-05 · Updated 2026-01-02 · CVE-2024-27916

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Minder versions prior to 0.0.33

Description A Minder user can use the endpoints GetRepositoryByName, DeleteRepositoryByName, and GetArtifactByName to access any repository in the database, irrespective of who owns the repository and any permissions present. The database query checks by repo owner, repo name, and provider name (which is always "github"). These query values are not distinct for the particular user, as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repository. This issue affects any user and project in a multi-tenant Minder instance.

Recommendations To resolve this issue, update to version 0.0.33 or later. As a temporary workaround, consider restricting access to the GetRepositoryByName, DeleteRepositoryByName, and GetArtifactByName endpoints until a patch is applied. Additionally, restrict the use of the DeleteRepositoryByName function to prevent unauthorized deletion of repositories. Avoid using the GetArtifactByName endpoint until the issue is resolved.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-27916

GHSA-V627-69V2-XX37

GO-2024-2608

Affected Products

Minder

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27916.json · Exploit
• https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb · Patch
• https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27916 · Security Note
• https://osv.dev/vulnerability/GO-2024-2608 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v627-69v2-xx37 · Vendor Advisory
• https://github.com/stacklok/minder · Note
• https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299 · Note
• https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278 · Note
• https://twitter.com/cracbot/status/1771321507043565585 · Twitter Post
• https://t.me/cveNotify/147512 · Telegram Post