PT-2023-26894 · Spinnaker · Spinnaker

Jasonmcintosh · Published 2023-08-28 · Updated 2023-09-01 · CVE-2023-39348

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spinnaker (affected versions not specified)

Description Spinnaker is an open source, multi-cloud continuous delivery platform. The log output when updating GitHub status is improperly set to FULL always, which could output GitHub tokens to a log system. This issue affects users of GitHub Status Notifications and may grant elevated access to repositories outside of control. If using READ restricted tokens, the exposure could allow access to resources otherwise restricted from reads.

Recommendations To resolve the issue, apply the patch and rotate the GitHub token used for GitHub status notifications. As a temporary workaround, disable GH Status Notifications. Filter logs for Echo log data to minimize the risk of token exposure. Use read-only tokens that are limited in scope to reduce the impact of potential token exposure.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-39348

GHSA-RQ5C-HVW6-8PR7

Affected Products

Spinnaker

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39348.json · Exploit
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-rq5c-hvw6-8pr7 · Vendor Advisory
• https://github.com/spinnaker/echo/pull/1316 · Patch
• https://osv.dev/vulnerability/GHSA-rq5c-hvw6-8pr7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39348 · Security Note
• https://github.com/spinnaker/spinnaker · Note
• https://t.me/cvenotify/57505 · Telegram Post
• https://t.me/cibsecurity/69326 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1696290212110811261 · Twitter Post
• https://twitter.com/CVEnew/status/1696255417616060506 · Twitter Post
• https://t.me/cvenotify/57455 · Telegram Post