CVE-2024-31216
source-controller leaks Azure Storage SAS token into logs
Impact
### Impact When source-controller is configured to use an [Azure SAS token](https://v2-2.docs.fluxcd.io/flux/components/source/buckets/#azure-blob-sas-token-example) when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. ### Patches This vulnerability was fixed in source-controller **v1.2.5**. ### Workarounds There is no workaround for this vulnerability except for using a different auth mechanism such as [Azure Workload Identity](https://v2-2.docs.fluxcd.io/flux/components/source/buckets/#azure). ### Credits This issue was reported and fixed by Jagpreet Singh Tamber (@jagpreetstamber) from the Azure Arc team. ### References https://github.com/fluxcd/source-controller/pull/1430 ### For more information If you have any questions or comments about this advisory: - Open an issue in the source-controller repository. - Contact us at the CNCF Flux Channel.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/fluxcd/source-controller | < 1.2.5 | 1.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9
- https://github.com/fluxcd/source-controller/pull/1430
- https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w
- https://github.com/advisories/GHSA-v554-xwgw-hc3w
- https://nvd.nist.gov/vuln/detail/CVE-2024-31216