CVE-2024-35194

Executive Summary

CVE-2024-35194 is a denial-of-service (DoS) vulnerability in Minder, a software supply chain security platform. The vulnerability allows an attacker to cause memory exhaustion by providing maliciously crafted templates. Minder uses templating to generate strings for various use cases, and in some cases, the user can control both the template and its parameters. When these conditions are met, an attacker can generate large templates that exhaust memory, causing the Minder engine to crash. The vulnerability is fixed in version 0.0.50.

Supply Chain & Package Security

This vulnerability is in the Minder platform itself, which is a Go-based application. The supply chain risk is that an attacker could exploit this to cause a denial of service, potentially disrupting the software supply chain security operations that Minder is meant to protect. The fix is available in version 0.0.50, and users should update immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium. The vulnerability requires low privileges and no user interaction, but only affects availability.

Deep Dive & Mechanics

The vulnerability resides in the Minder engine's templating functionality. Minder uses templates to generate strings for URLs, pull request messages, and advisory descriptions. In certain scenarios, the user can control both the template and its parameters. When the template is generated, Minder reads the entire generated string into memory. If an attacker provides a template that expands to a very large size (e.g., through repeated string concatenation or loops), the memory consumption can grow uncontrollably, leading to a denial of service.

The root cause is the lack of input size validation and memory limits on template expansion. The fix in version 0.0.50 likely introduces a maximum size limit for generated templates.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func generateTemplate(template string, params map[string]string) string {
    // No size limit on the generated output
    result := executeTemplate(template, params)
    return result
}

Patched Code (Conceptual):

const maxTemplateSize = 1024 * 1024 // 1 MB limit

func generateTemplate(template string, params map[string]string) (string, error) {
    result := executeTemplate(template, params)
    if len(result) > maxTemplateSize {
        return "", errors.New("template output exceeds maximum allowed size")
    }
    return result, nil
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to:

1. Gain access to a Minder instance with the ability to create or modify templates.
2. Craft a template that expands to a very large string. For example, using a loop that repeats a string many times.
3. Submit the template to the Minder engine.
4. The engine will attempt to generate the template, consuming excessive memory and crashing.

Example malicious template (conceptual):

{{ range $i := loop 1000000 }}{{ "A" }}{{ end }}

Blue Team

To detect exploitation attempts:

1. Monitor memory usage on Minder servers. A sudden spike in memory consumption may indicate an attack.
2. Log template generation requests and look for unusually large template sizes.
3. Implement rate limiting on template creation and modification endpoints.

Indicators of Compromise (IOCs)

• Memory exhaustion logs: Logs showing out-of-memory errors in the Minder engine.
• Large template sizes: Templates that exceed expected size limits (e.g., >1 MB).
• Crash logs: Logs indicating the Minder process crashed due to memory exhaustion.

Detection Engineering

YARA Rule

rule CVE_2024_35194_Minder_Template_DoS {
    meta:
        description = "Detects potential malicious templates for CVE-2024-35194"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35194"
    strings:
        $template_loop = /{{.*range.*loop.*}}/ nocase
        $large_string = /{{.*"A"{1000,}.*}}/ nocase
    condition:
        any of them
}

Sigma Rule

title: Minder Template Memory Exhaustion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-35194 by submitting large templates
author: Valters IT
logsource:
    product: minder
    service: engine
detection:
    selection:
        event: "template_generation"
        template_size: "> 1048576"  # 1 MB
    condition: selection
falsepositives:
    - Legitimate large templates (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35194 Minder Template DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/template"; http_uri; pcre:"/template_size=[0-9]{7,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Minder to version 0.0.50 or later.
2. Workaround: If upgrading is not possible, restrict access to template creation/modification endpoints to trusted users only.
3. Long-term: Implement input validation and size limits on all template generation operations. Monitor memory usage and set alerts for abnormal consumption.

Valters IT