cve/2024/CVE-2024-37904.md

### [CVE-2024-37904](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37904)
![](https://img.shields.io/static/v1?label=Product&message=minder&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%200.0.52%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brighgreen)

### Description

Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the `github.com/go-git/go-git/v5` library on lines `L55-L89`. The Git provider does the following on the lines `L56-L62`. First, it sets the `CloneOptions`, specifying the url, the depth etc. It then validates the options. It then sets up an in-memory filesystem, to which it clones and Finally, it clones the repository. The `(g *Git) Clone()` method is vulnerable to a DoS attack: A Minder user can instruct Minder to clone a large repository which will exhaust memory and crash the Minder server. The root cause of this vulnerability is a combination of the following conditions: 1. Users can control the Git URL which Minder clones, 2. Minder does not enforce a size limit to the repository, 3. Minder clones the entire repository into memory. This issue has been addressed in commit `7979b43` which has been included in release version v0.0.52. Users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666

#### Github
No PoCs found on GitHub currently.