GHSA-26hr-q2wp-rvc5 Impact When lakeFS is configured with **ALL** of the following: - Configuration option `auth.encrypt.secret_key` passed through environm
A low-privilege user can impersonate others if lakeFS uses environment variables for encryption keys and has actions enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-26hr-q2wp-rvc5?
GHSA-26hr-q2wp-rvc5 is an authentication bypass vulnerability in github.com/treeverse/lakefs, published on 12 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
When lakeFS is configured with ALL of the following:
- Configuration option
auth.encrypt.secret_keypassed through environment variable - Actions enabled via configuration option
actions.enabled(default enabled)
then a user who can configure an action can impersonate any other user.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
ANY ONE of these is sufficient to prevent the issue:
Do not pass
auth.encrypt.secret_keythrough an environment variable.For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.
Which versions are affected by GHSA-26hr-q2wp-rvc5?
3 open source packages ship an affected version, including github.com/treeverse/lakefs.
| Package | Affected | Fixed in |
|---|---|---|
github.com/treeverse/lakefs Go | All versions | 1.3.1 |
github.com/treeverse/lakefs Go | All versions | 1.3.1 |
github.com/treeverse/lakefs Go | All versions | 1.3.1 |
How do I fix GHSA-26hr-q2wp-rvc5?
Upgrade github.com/treeverse/lakefs to 1.3.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-26hr-q2wp-rvc5 being exploited?
There is no known exploitation of GHSA-26hr-q2wp-rvc5 in the wild and no public exploit code.
Sources
Also known as GO-2023-2397.