PT-2024-26364 · Go-Git+1 · Go-Git+1

Luhring · Published 2024-05-15 · Updated 2024-06-04 · CVE-2024-35183

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wolfictl versions prior to 0.16.10

Description A git authentication issue allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function GetGitAuth looks for a GitHub token in the environment variable GITHUB TOKEN and returns it as an HTTP basic auth object to be used with the github.com/go-git/go-git/v5 library. Most callers of GetGitAuth use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior impacts anyone who ran the wolfictl check update commands with a Melange configuration that included a git-checkout directive step that referenced a git repository not hosted on github.com, or anyone who ran wolfictl update <url> with a remote URL outside of github.com, and had the GITHUB TOKEN environment variable set to a valid GitHub token.

Recommendations To resolve the issue, upgrade to version 0.16.10 to receive a patch. As a temporary workaround, consider removing the GITHUB TOKEN environment variable when running wolfictl check update or wolfictl update <url> commands with remote URLs outside of github.com. Restrict access to the GetGitAuth function to minimize the risk of exploitation. Avoid using the GITHUB TOKEN environment variable in the affected API endpoints until the issue is resolved.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Files Accessible to External Parties

Weakness Enumeration

CWE-668

CWE-552

Related Identifiers

CVE-2024-35183

GHSA-8FG7-HP93-QHVR

GO-2024-2863

Affected Products

Go-Git

Wolfictl

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35183.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-35183 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35183 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8fg7-hp93-qhvr · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2863 · Vendor Advisory
• https://github.com/wolfi-dev/wolfictl/security/advisories/GHSA-8fg7-hp93-qhvr · Note
• https://github.com/wolfi-dev/wolfictl/blob/4dd6c95abb4bc0f9306350a8601057bd7a92bded/pkg/update/deps/cleanup.go#L49 · Note
• https://github.com/wolfi-dev/wolfictl/commit/403e93569f46766b4e26e06cf9cd0cae5ee0c2a2 · Note
• https://github.com/wolfi-dev/wolfictl/blob/6d99909f7b1aa23f732d84dad054b02a61f530e6/pkg/git/git.go#L22 · Note
• https://github.com/wolfi-dev/wolfictl/commit/0d06e1578300327c212dda26a5ab31d09352b9d0 · Note
• https://github.com/wolfi-dev/wolfictl · Note
• https://github.com/wolfi-dev/wolfictl/blob/488b53823350caa706de3f01ec0eded9350c7da7/pkg/update/update.go#L143 · Note