PT-2021-11235 · Unknown+2 · Vela Compiler+2

Matt-Fevold + 1 · Published 2021-01-04 · Updated 2024-08-21 · CVE-2020-26294

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vela versions prior to 0.6.1 Vela compiler versions prior to 0.6.1

Description: The issue allows exposure of server configuration, impacting all users of Vela. An attacker can use Sprig's env function to retrieve configuration information. This can be done via pipeline template functionality. For example, using the env function in a template to echo sensitive information such as VELA SOURCE CLIENT or VELA SECRET.

Recommendations: For versions prior to 0.6.1, upgrade to version 0.6.1. Rotate all secrets to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of Sprig's env function in pipeline templates until the issue is resolved.

Exploit

Fix

Information Disclosure

OS Command Injection

Weakness Enumeration

CWE-200

CWE-78

Related Identifiers

CVE-2020-26294

GHSA-GV2H-GF8M-R68J

GO-2022-0838

Affected Products

Sprig

Vela

Vela Compiler

References · 9

• 🔥 https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j · Exploit
• https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26294 · Security Note
• https://osv.dev/vulnerability/GHSA-gv2h-gf8m-r68j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0838 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26294 · Vendor Advisory
• https://github.com/helm/helm/blob/6297c021cbda1483d8c08a8ec6f4a99e38be7302/pkg/engine/funcs.go#L46-L47 · Note
• https://t.me/cibsecurity/21555 · Telegram Post
• https://pkg.go.dev/github.com/go-vela/compiler/compiler · Note