Vulnerability · Published Nov 8, 2024 · Assigned by GitHub_M
CVE-2024-52009Git credentials are exposed in atlantis logs
High 8.5
In plain English
A high-severity sensitive data in logs in atlantis from runatlantis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/runatlantis/atlantis | 0.30.0 | GHSA-gppm-hq3p-h4rp |
| Go | github.com/runatlantis/atlantis | 0.30.0 | GO-2024-3265 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| runatlantis | atlantis | < 0.30.0 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
References
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rp x_refsource_CONFIRM
- https://github.com/runatlantis/atlantis/issues/4060 x_refsource_MISC
- https://github.com/runatlantis/atlantis/pull/4667 x_refsource_MISC
- https://argo-cd.readthedocs.io/en/stable/operator-manual/security x_refsource_MISC
- https://github.com/runatlantis/atlantis/releases/tag/v0.30.0 x_refsource_MISC