-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siderolabs/omni | go | >= 1.1.0-beta.0, <= 1.1.4 | 1.1.5 |
| github.com/siderolabs/omni | go | <= 1.0.1 | 1.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic nil pointer dereference in the omni backend, specifically within the grpc.CreateResource function located in internal/backend/grpc/resource.go. The function directly accessed a field on the Metadata struct of a resource without verifying if the Metadata object itself was nil. This oversight allows an unauthenticated attacker to crash the server by sending a specially crafted, empty JSON payload to the Create or Update API endpoints of the ResourceService.
The analysis of the provided patches confirms this. The core of the fix is in grpc.CreateResource, where checks for resource == nil and resource.Metadata == nil were added. This directly mitigates the crash.
Two primary code paths lead to the vulnerable function:
main.isSensitiveSpec function (in internal/backend/server.go), which is called during the resource creation process.grpc.ResourceServer.Update method (in internal/backend/grpc/resource.go), which handles resource update requests.Both of these functions passed the user-provided resource directly to grpc.CreateResource without prior validation, making them the entry points for exploitation. A runtime profile or stack trace during an exploit would show a call chain involving one of these entry points leading to the panic in grpc.CreateResource. Therefore, all three functions are included as they are critical to understanding and detecting the exploitation of this vulnerability.