PT-2021-14504 · Vela · Vela
Jordan Sussman
·
Published
2021-04-09
·
Updated
2024-08-21
·
CVE-2021-21432
CVSS v3.1
7.5
High
| Vector | AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Vela versions 0.7.0 through 0.7.4
Description
The issue concerns an authentication mechanism added in version 0.7.0 of Vela, which enables malicious users to obtain secrets by utilizing injected credentials within the
~/.netrc file. This can be achieved by creating a Vela server, logging in to the Vela UI, promoting oneself to a Vela administrator, activating a repository, and adding a .vela.yml file with specific content to the repository. The vulnerability allows access to secrets, which can be obtained by running a script with environment-specific settings.Recommendations
For Vela versions 0.7.0 through 0.7.4, upgrade to version 0.7.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
~/.netrc file and the github.com/go-vela/server API endpoint to minimize the risk of exploitation.
Avoid using the VELA TOKEN environment variable in the affected API endpoint until the issue is resolved.Fix
Incorrect Authorization
Missing Authorization
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vela