PT-2024-35093 · Atlantis · Atlantis

Niooss-Ledger · Published 2024-11-08 · Updated 2024-11-21 · CVE-2024-52009

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlantis versions prior to 0.30.0

Description The issue concerns the exposure of GitHub credentials in Atlantis logs, specifically tokens starting with ghs ..., when they are rotated. This allows an attacker who can read these logs to impersonate the Atlantis application and perform actions on GitHub, potentially gaining administration privileges on a GitHub organization if Atlantis is used for administration. The problem was reported and fixed, with the fix included in Atlantis v0.30.0.

Recommendations For versions prior to 0.30.0, upgrade to Atlantis v0.30.0 to resolve the issue. As a temporary workaround, consider restricting access to the Atlantis logs to minimize the risk of credential exposure. Additionally, review and limit the privileges assigned to the GitHub credentials used by Atlantis to reduce the potential impact of impersonation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-52009

GHSA-GPPM-HQ3P-H4RP

GO-2024-3265

OPENSUSE-SU-2024:14515-1

Affected Products

Atlantis

References · 21

• 🔥 https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52009.json · Exploit
• https://osv.dev/vulnerability/GO-2024-3265 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52009 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14515-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52009 · Security Note
• https://osv.dev/vulnerability/GHSA-gppm-hq3p-h4rp · Vendor Advisory
• https://github.com/runatlantis/atlantis · Note
• https://github.com/runatlantis/atlantis/releases/tag/v0.30.0 · Note
• https://github.com/runatlantis/atlantis/pull/4667 · Note
• https://github.com/runatlantis/atlantis/issues/4060 · Note
• https://github.com/runatlantis/atlantis/commit/0def7d3fb74aabb75570554692b053950cde02e1 · Note
• https://suse.com/security/cve/CVE-2024-52009 · Note
• https://suse.com/security/cve/CVE-2024-8986 · Note
• https://twitter.com/CVEnew/status/1855020307456680176 · Twitter Post