YugabyteDB Anywhere prior 2.20.7.0/2.23.1.0/2024.1.3.0 Backup Configuration log file

Summaryinfo

A vulnerability was found in YugabyteDB Anywhere. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Backup Configuration Handler. Performing a manipulation results in log file. This vulnerability is identified as CVE-2024-11165. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in YugabyteDB Anywhere. It has been classified as problematic. This affects an unknown function of the component Backup Configuration Handler. The manipulation with an unknown input leads to a log file vulnerability. CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality. The summary by CVE is:

An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token. This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-11165 since 11/12/2024. The exploitability is told to be difficult. An attack has to be approached locally. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.20.7.0, 2.23.1.0 or 2024.1.3.0 eliminates this vulnerability. Applying the patch 920989b6c0db0222bb7a0cce46febc76cf72d438 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• YugabyteDB

Name

• Anywhere

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion