PT-2024-26373 · Minder · Minder
Adamkorcz
·
Published
2024-05-20
·
Updated
2024-06-05
·
CVE-2024-35194
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Minder versions prior to 0.0.50
Description
Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases, the user can control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minder's templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. The issue is related to the REST ingester, where an attacker can make Minder generate a large template by invoking
endpoint.String() with control over both the endpoint and the retp parameter.Recommendations
For versions prior to 0.0.50, update to version 0.0.50 to fix the vulnerability. As a temporary workaround, consider limiting the size of generated templates before reading them into memory to prevent memory exhaustion. Restrict access to the vulnerable templating engine to minimize the risk of exploitation. Avoid using large templates in the affected API endpoints until the issue is resolved.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Minder