CVE-2024-27093

Executive Summary

CVE-2024-27093 is a vulnerability in Minder, a Software Supply Chain Security Platform, affecting versions 0.0.31 and earlier. The flaw allows an attacker with admin access to a repository to register it with an invalid or differing upstream ID. This causes Minder to report the repository as registered, but webhooks for the repo do not match any known repository in the database, preventing policy remediations from executing. The vulnerability primarily enables a denial-of-service (DoS) condition by rendering policy enforcement ineffective for the affected repository. The CVSS score is 4.6 (Medium), and the issue is patched in version 0.20240226.1425+ref.53868a8.

Supply Chain & Package Security

Minder is a Go-based software supply chain security platform. The vulnerability affects the repository registration and webhook validation logic, which is critical for enforcing security policies across the software supply chain. An attacker exploiting this flaw can bypass policy enforcement, potentially allowing malicious changes to go undetected in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (attacker must have admin access to the repository)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low (policy enforcement is disrupted, leading to potential DoS of security controls)

Deep Dive & Mechanics

The vulnerability lies in the repository registration process in Minder. When a user registers a repository, Minder stores the upstream repository ID (e.g., from GitHub) and sets up webhooks to monitor changes. In vulnerable versions, the system does not properly validate that the provided upstream ID matches the actual repository. An attacker with admin access to a repository can register it with a different or invalid upstream ID. This causes Minder to:

• Report the repository as successfully registered.
• Fail to match incoming webhooks to the database entry because the webhook payload contains the real upstream ID, not the attacker-supplied one.
• Skip policy remediations for any changes made to the repository, as the webhook handler cannot find a matching repository.

The attack requires the attacker to have admin privileges on the repository (or a token with such access). If the token lacks repo access, remediations will also fail, but the primary impact is the inability to enforce policies. Reconciliation actions (periodic checks) also do not execute against mismatched repos, exacerbating the issue.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func RegisterRepo(repoID string, upstreamID string) {
    // No validation that upstreamID matches the actual repo
    db.Save(Repo{ID: repoID, UpstreamID: upstreamID})
    // Webhook setup proceeds with the mismatched upstreamID
}

Patched Code (simplified):

func RegisterRepo(repoID string, upstreamID string) error {
    actualUpstreamID := getActualUpstreamID(repoID) // e.g., from GitHub API
    if upstreamID != actualUpstreamID {
        return errors.New("upstream ID mismatch")
    }
    db.Save(Repo{ID: repoID, UpstreamID: upstreamID})
    return nil
}

The patch adds a validation step that checks the provided upstream ID against the actual repository's upstream ID before registration.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin access to a GitHub repository (or similar provider).
• A running Minder instance (version 0.0.31 or earlier) with a provider token that has admin scope.

Steps:

1. Obtain a valid provider token with admin access to the target repository.
2. Use Minder's API to register the repository, but provide a different upstream ID (e.g., a non-existent repo ID or a different repo's ID).
3. Confirm that Minder reports the repository as registered.
4. Make a change to the repository (e.g., push a commit that violates a policy). Observe that no remediation action is taken by Minder.

Example API call (conceptual):

curl -X POST https://minder.example.com/api/v1/repos \
  -H "Authorization: Bearer <token>" \
  -d '{"repo_name": "victim/repo", "upstream_id": "12345"}'  # Fake upstream ID

Blue Team

Detection:

• Monitor Minder logs for registration events where the upstream ID does not match the expected repository ID.
• Alert on any repository registration that fails webhook validation (e.g., webhook events with no matching repo in the database).

Hunting:

• Query the Minder database for repositories where the upstream_id field does not match the actual upstream ID from the provider API.
• Check for repositories that are registered but have no recent webhook activity or remediation actions.

Mitigation:

• Immediately upgrade Minder to version 0.20240226.1425+ref.53868a8 or later.
• If upgrade is not possible, manually validate upstream IDs during registration by cross-referencing with the provider API.

Indicators of Compromise (IOCs)

• Log Entries: Minder logs showing repository registration with an upstream ID that differs from the actual repository ID.
• Database Records: Repositories in the Minder database with upstream_id values that do not match the provider's repository ID.
• Webhook Failures: Increased number of webhook events that cannot be matched to any repository in the database.
• Policy Violations: Unremediated policy violations in repositories that are registered but not actively monitored.

Detection Engineering

YARA Rule

rule CVE_2024_27093_Minder_Repo_Mismatch {
    meta:
        description = "Detects Minder repository registration with mismatched upstream ID"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27093"
    strings:
        $s1 = "RegisterRepo" ascii wide nocase
        $s2 = "upstream_id" ascii wide nocase
        $s3 = "mismatch" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: Minder Repository Registration with Mismatched Upstream ID
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to register a repository with an invalid or differing upstream ID in Minder (CVE-2024-27093)
author: Valters IT
date: 2025-04-10
logsource:
    product: minder
    service: api
detection:
    selection:
        event: "repo_registration"
        upstream_id|re: "^[0-9]+$"  # Example pattern for mismatched IDs
    condition: selection
falsepositives:
    - Legitimate registration with correct upstream ID
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27093 Minder Repository Registration with Mismatched Upstream ID"; flow:to_server; content:"POST"; http_method; content:"/api/v1/repos"; http_uri; content:"upstream_id"; http_client_body; pcre:"/upstream_id[^&]*&/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Minder to version 0.20240226.1425+ref.53868a8 or later.
2. Workaround: If upgrade is not possible, implement manual validation of upstream IDs during repository registration by comparing the provided ID with the actual repository ID from the provider API.
3. Monitoring: Enable detailed logging for repository registration events and webhook processing. Set up alerts for mismatched upstream IDs.
4. Access Control: Restrict repository registration to trusted users with verified admin access. Regularly audit provider tokens and their scopes.
5. Policy Enforcement: Ensure reconciliation actions are configured to run frequently and alert on failures.

Valters IT