PT-2024-23857 · Fluxcd · Source-Controller
Jagpreet Singh Tamber
+1
·
Published
2024-05-15
·
Updated
2024-06-04
·
CVE-2024-31216
CVSS v3.1
5.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
source-controller versions prior to 1.2.5
Description
The source-controller is a Kubernetes operator that implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. It is specialized in artifacts acquisition from external sources such as Git, OCI, Helm repositories, and S3-compatible buckets. When the source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token is logged along with the Azure URL when the controller encounters a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires.
Recommendations
For versions prior to 1.2.5, update to version 1.2.5 to fix the vulnerability. As a temporary workaround, consider using a different auth mechanism such as Azure Workload Identity.
Exploit
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Source-Controller