Microsoft Power Platform Terraform Provider up to 2.7.0 client_secret neutralization for logs

Summaryinfo

A vulnerability described as problematic has been identified in Microsoft Power Platform Terraform Provider up to 2.7.0. Impacted is an unknown function. The manipulation of the argument client_secret results in neutralization for logs. This vulnerability is cataloged as CVE-2024-47083. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Microsoft Power Platform Terraform Provider up to 2.7.0. Affected is an unknown code block. The manipulation of the argument client_secret with an unknown input leads to a neutralization for logs vulnerability. CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. This is going to have an impact on confidentiality. CVE summarizes:

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the service principal authentication, may be exposed in logs. This exposure occurs due to an error in the logging code that causes the `client_secret` to not be properly masked when logs are persisted or viewed. Users should upgrade to version 3.0.0 to receive a patched version of the provider that removes all logging of sensitive content. Users who have used this provider with the affected versions should take the following additional steps to mitigate the risk: Immediately rotate the `client_secret` for any service principal that has been configured using this Terraform provider. This will invalidate any potentially exposed secrets. Those who have set the `TF_LOG_PATH` environment variable or configured Terraform to persist logs to a file or an external system, consider disabling this until they have updated to a fixed version of the provider. Those who have existing logs that may contain the `client_secret` should remove or sanitize these logs to prevent unauthorized access. This includes logs on disk, in monitoring systems, or in logging services.

The advisory is available at github.com. This vulnerability is traded as CVE-2024-47083 since 09/17/2024. The exploitability is told to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 3.0.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Microsoft

Name

• Power Platform Terraform Provider

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7.0

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion