PT-2023-12724 · Weave · Weave Gitops

Pjbgf · Published 2023-01-09 · Updated 2024-08-20 · CVE-2022-23509

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weave GitOps versions prior to v0.12.0

Description The communication between GitOps Run and the local S3 bucket is not encrypted, allowing privileged users or processes to tap the local traffic and gain information permitting access to the S3 bucket. This could result in changes to the bucket content, leading to modifications in the Kubernetes cluster's resources. There are no known workarounds for this issue.

Recommendations For Weave GitOps versions prior to v0.12.0, upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022. As a temporary workaround, consider restricting access to the local S3 bucket to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

CVE-2022-23509

GHSA-89QM-WCMW-3MGG

GO-2023-1388

Affected Products

Weave Gitops

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23509.json · Exploit
• https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967 · Patch
• https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23509 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89qm-wcmw-3mgg · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1388 · Vendor Advisory
• https://github.com/weaveworks/weave-gitops · Note
• https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg · Note
• https://t.me/cibsecurity/56154 · Telegram Post
• https://t.me/cvenotify/41561 · Telegram Post