Invalid Upstream ID in Minder Can Lead to Denial of Service Vulnerability

CVE-2024-27093

What is CVE-2024-27093?

Minder, a Software Supply Chain Security Platform, contains a vulnerability that allows attackers to register a repository by using an invalid or differing upstream ID. This results in Minder inaccurately reporting the repository as registered, but it fails to address any future changes that contradict policy requirements since the webhooks do not align with known repositories in the database. If an attacker tries to register a repository using a different ID, they must have administrative privileges on that repository, or else they will encounter a 404 error. Furthermore, if the associated provider token lacks the necessary repository access, remediation attempts will not be executed. As a result, reconciliation actions may not occur for repositories experiencing this ID mismatch, potentially leading to service disruptions. The vulnerability is addressed in version 0.20240226.1425+ref.53868a8.

References