CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds
Attackers can read sensitive AWS credentials from unmasked Packer build logs in Spinnaker Rosco, potentially leading to cloud account compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23506?
CVE-2022-23506 is a medium-severity vulnerability in spinnaker, published on 3 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposure of sensitive AWS credentials in packer log files. Versions 1.29.2, 1.28.4, and 1.27.3 of Rosco contain fixes for this issue.
A workaround is available. It's recommended to use short lived credentials via role assumption and IAM profiles. Additionally, credentials can be set in `/home/spinnaker/.aws/credentials` and `/home/spinnaker/.aws/config` as a volume mount for Rosco pods vs. setting credentials in roscos bake config properties. Last even with those it's recommend to use IAM Roles vs. long lived credentials. This drastically mitigates the risk of credentials exposure. If users have used static credentials, it's recommended to purge any bake logs for AWS, evaluate whether AWS_ACCESS_KEY, SECRET_KEY and/or other sensitive data has been introduced in log files and bake job logs. Then, rotate these credentials and evaluate potential improper use of those credentials.
Weakness: CWE-532
Which versions are affected by CVE-2022-23506?
It affects 1 product.
Products include Linuxfoundation Spinnaker.
How do I fix CVE-2022-23506?
No fix has been published for CVE-2022-23506 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23506 being exploited?
There is no known exploitation of CVE-2022-23506 in the wild and no public exploit code.
Other vulnerabilities in spinnaker
- CVE-2026-32604 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
- CVE-2026-32613 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- CVE-2021-43832 Improper Access Control in spinnaker
- CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
- CVE-2020-9301 Code injection in Netflix Spinnaker
Sources
Also known as GHSA-2233-cqj8-j2q5.