Weave GitOps up to 0.8.1-rc.5 log file

Summaryinfo

A vulnerability identified as problematic has been detected in Weave GitOps up to 0.8.1-rc.5. This issue affects some unknown processing. This manipulation causes log file. This vulnerability is registered as CVE-2022-31098. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Weave GitOps up to 0.8.1-rc.5 and classified as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster. This vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters. A successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters. This vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version v0.8.1-rc.6 or newer. There is no known workaround for this vulnerability.

The weakness was published 06/28/2022 as GHSA-xggc-qprg-x6mw. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2022-31098 since 05/18/2022. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 0.8.1-rc.6 eliminates this vulnerability. Applying the patch 567356f471353fb5c676c77f5abc2a04631d50ca is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Weave

Name

• GitOps

Version

• 0.8.1-rc.0
• 0.8.1-rc.1
• 0.8.1-rc.2
• 0.8.1-rc.3
• 0.8.1-rc.4
• 0.8.1-rc.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion