CVE-2024-27093: Minder trusts client-provided mapping from repo name to upstream ID

February 26, 2024 (updated February 5, 2025)

When using a modified client or the grpc interface directly, the RegisterRepository call accepts both the repository owner / repo and the repo_id. Furthermore, these two are not checked for matching before registering webhooks and data in the database.

References

github.com/advisories/GHSA-q6h8-4j2v-pjg4
github.com/stacklok/minder
github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d
github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4
nvd.nist.gov/vuln/detail/CVE-2024-27093
pkg.go.dev/vuln/GO-2024-2582

Detect and mitigate CVE-2024-27093 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →