PT-2024-13377 · Cubefs · Cubefs

Adamkorcz · Published 2024-01-03 · Updated 2024-06-28 · CVE-2023-46742

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CubeFS versions prior to 3.3.1

Description CubeFS is an open-source cloud-native file storage system that was found to leak users' secret keys and access keys in the logs in multiple components. When CubeFS creates new users, it leaks the users' secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. There is no evidence of this issue being exploited in the wild, and it was discovered during a security audit.

Recommendations For CubeFS versions prior to 3.3.1, the issue can be resolved by upgrading to version 3.3.1 or later. There is no other mitigation than upgrading CubeFS.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-46742

GHSA-VWCH-G97W-HFG2

GO-2024-2434

Affected Products

Cubefs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46742.json · Exploit
• https://github.com/cubefs/cubefs/commit/8dccce6ac8dff3db44d7e9074094c7303a5ff5dd · Patch
• https://osv.dev/vulnerability/GHSA-vwch-g97w-hfg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46742 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46742 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2434 · Vendor Advisory
• https://github.com/cubefs/cubefs/security/advisories/GHSA-vwch-g97w-hfg2 · Note
• https://github.com/cubefs/cubefs · Note
• https://twitter.com/CVEnew/status/1742586770007454071 · Twitter Post
• https://t.me/cibsecurity/74332 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1742632952566014108 · Twitter Post
• https://t.me/cvenotify/66937 · Telegram Post