Sylabs scs-library-client 1.x/2.x insufficiently protected credentials

Summaryinfo

A vulnerability identified as problematic has been detected in Sylabs scs-library-client 1.x/2.x. This issue affects some unknown processing. Performing a manipulation results in insufficiently protected credentials. This vulnerability is identified as CVE-2022-23538. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as problematic has been found in Sylabs scs-library-client 1.x/2.x (Software Library). This affects some unknown functionality. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.

The weakness was released 01/18/2023 as GHSA-7p8m-22h4-9pj7. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-23538 since 01/19/2022. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Applying the patch 68ac4cab5cda0afd8758ff5b5e2e57be6a22fcfa is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Sylabs

Name

• scs-library-client

Version

• 1.x
• 2.x

License

• open-source

Website

• Product: https://github.com/sylabs/scs-library-client/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion