目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2024-35238— Minder 安全漏洞

一分钟漏洞结论

影响对象
stacklok minder
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Minder是一个开源平台，可帮助开发团队和开源社区构建更安全的软件，并向其他人证明他们构建的软件是安全的。 Minder 0.0.51之前版本存在安全漏洞，该漏洞源于验证程序将不受信任的响应完全读取到内存中，而没有对响应正文实施限制，容易受到拒绝服务(DoS)攻击。

CVSS 5.3 · Medium EPSS 0.53% · P43
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2024-35238 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Denial of service of Minder Server from maliciously crafted GitHub attestations
来源: CVE Program / CVE List V5
Vulnerability Description
Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on the response body. An attacker can exploit this by making Minder make a request to an attacker-controlled endpoint which returns a response with a large body which will crash the Minder server. Specifically, the point of failure is where Minder parses the response from the GitHub attestations endpoint in `getAttestationReply`. Here, Minder makes a request to the `orgs/$owner/attestations/$checksumref` GitHub endpoint (line 285) and then parses the response into the `AttestationReply` (line 295). The way Minder parses the response on line 295 makes it prone to DoS if the response is large enough. Essentially, the response needs to be larger than the machine has available memory. Version 0.0.51 contains a patch for this issue. The content that is hosted at the `orgs/$owner/attestations/$checksumref` GitHub attestation endpoint is controlled by users including unauthenticated users to Minders threat model. However, a user will need to configure their own Minder settings to cause Minder to make Minder send a request to fetch the attestations. The user would need to know of a package whose attestations were configured in such a way that they would return a large response when fetching them. As such, the steps needed to carry out this attack would look as such: 1. The attacker adds a package to ghcr.io with attestations that can be fetched via the `orgs/$owner/attestations/$checksumref` GitHub endpoint. 2. The attacker registers on Minder and makes Minder fetch the attestations. 3. Minder fetches attestations and crashes thereby being denied of service.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
来源: CVE Program / CVE List V5
Vulnerability Title
Minder 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Minder是一个开源平台，可帮助开发团队和开源社区构建更安全的软件，并向其他人证明他们构建的软件是安全的。 Minder 0.0.51之前版本存在安全漏洞，该漏洞源于验证程序将不受信任的响应完全读取到内存中，而没有对响应正文实施限制，容易受到拒绝服务(DoS)攻击。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
stacklok minder < 0.0.51 -

二、漏洞 CVE-2024-35238 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2024-35238 的情报信息

请登录查看更多情报信息。

CVE-2024-35238 补丁与修复 (1)

CVE-2024-35238 厂商安全公告 (1)

CVE-2024-35238 其他参考 (1)

IV. Related Vulnerabilities

Same product: minder
Same vendor: stacklok
Same weakness: CWE-770

V. Comments for CVE-2024-35238

暂无评论

发表评论