Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

Affected: Go: github.com/mindersec/minder

### Impact

Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition).

### Patches

https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8

### Workarounds

Users should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.

### References

Sample ruletype:

```yaml version: v1 type: rule-type name: test-http-send display_name: Test that we can call http.send short_failure_message: Failed http.send severity: value: medium context: provider: github description: | ... guidance: | .... def: in_entity: repository rule_schema: type: object properties: {} ingest: type: git git: {} eval: type: rego violation_format: text rego: type: constraints def: | package minder

import rego.v1

violations contains {"msg": "Check-execution"}

resp := http.send({ "method": "GET", "url": "http://openfga:8080/", "raise_error": false, })

violations contains {"msg": sprintf("Response: %s", [resp.status])}

details := sprintf("High score: %s", [resp.body.summary])

violations contains {"msg": sprintf("Response body: %s", [resp.body]) }…