CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers
wolfictl may leak GitHub tokens to non-GitHub servers when accessing external repositories, exposing credentials to unauthorized parties.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-35183?
CVE-2024-35183 is a medium-severity vulnerability in wolfi-dev wolfictl, published on 15 May 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than `github.com`. Most git-dependent functionality in wolfictl relies on its own `git` package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function `GetGitAuth` looks for a GitHub token in the environment variable `GITHUB_TOKEN` and returns it as an HTTP basic auth object to be used with the `github.com/go-git/go-git/v5` library. Most callers (direct or indirect) of `GetGitAuth` use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior has existed in one form or another since commit 0d06e1578300327c212dda26a5ab31d09352b9d0 - committed January 25, 2023. This impacts anyone who ran the `wolfictl check update` commands with a Melange configuration that included a `git-checkout` directive step that referenced a git repository not hosted on github.com. This also impacts anyone who ran `wolfictl update <url>` with a remote URL outside of github.com. Additionally, these subcommands must have run with the `GITHUB_TOKEN` environment variable set to a valid GitHub token. Users should upgrade to version 0.16.10 to receive a patch.
Which versions are affected by CVE-2024-35183?
3 open source packages ship an affected version, including github.com/wolfi-dev/wolfictl.
| Package | Affected | Fixed in |
|---|---|---|
github.com/wolfi-dev/wolfictl Go | All versions | 0.16.10 |
github.com/wolfi-dev/wolfictl Go | All versions | 0.16.10 |
github.com/wolfi-dev/wolfictl Go | All versions | 0.16.10 |
How do I fix CVE-2024-35183?
Upgrade github.com/wolfi-dev/wolfictl to 0.16.10 or later.
Is CVE-2024-35183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35183 exists.
Sources
Also known as GHSA-8fg7-hp93-qhvr, GO-2024-2863.