Listen to this Post
The CVE-2024-49700 vulnerability in Minder is a Server-Side Request Forgery (SSRF) flaw originating from the `http.send` function within custom Rego rule types. This function, part of the policy evaluation engine, operates with the network permissions of the Minder server itself. An attacker can exploit this by crafting a malicious policy that uses `http.send` to make arbitrary HTTP requests from the Minder server. This allows the attacker to target and interact with internal systems that are accessible to the server but are otherwise shielded from external networks, such as databases, identity providers like OpenFGA or Keycloak, and other services on the local network. The evaluation results from the policy execution, including the HTTP response status and body, are then returned to the user, potentially leaking sensitive information from these internal endpoints.
Platform: Minder
Version: Pre-patch
Vulnerability: SSRF
Severity: Critical
date: 2024-10-31
Prediction: 2024-11-14
What Undercode Say:
minder profile status list -n test-http-send --json
package minder
import rego.v1
violations contains {"msg": "Check-execution"}
resp := http.send({
"method": "GET",
"url": "http://openfga:8080/",
"raise_error": false,
})
How Exploit:
Create a malicious policy ruletype utilizing the `http.send` Rego function to issue requests from the Minder server, targeting internal HTTP endpoints and retrieving the response data.
Protection from this CVE:
Apply the official patch from commit mindersec/minder@f770400. Restrict Minder’s server network access to only necessary internal services. Avoid deploying Minder in a network segment with access to sensitive infrastructure.
Impact:
Unauthorized internal network access. Information disclosure from internal services. Potential for further network reconnaissance and attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
