GHSA-4rgc-5g6r-2rjf lakeFS logs S3 credentials in plain text

Not scored Published 12 Dec 2023

lakeFS logs S3 credentials in plain text, allowing attackers with log access to steal cloud storage keys.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-4rgc-5g6r-2rjf?

GHSA-4rgc-5g6r-2rjf is a vulnerability in github.com/treeverse/lakefs, published on 12 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Impact

S3 credentials are logged in plain text

S3Creds:{Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

appears as part of the log message:

time=&#34;2023-05-12T13:51:52Z&#34; level=error msg=&#34;failed to perform diff&#34; func=&#34;pkg/plugins/diff.(*Service).RunDiff&#34; file=&#34;build/pkg/plugins/diff/service.go:124&#34; error=&#34;rpc error: code = Canceled desc = stream terminated by RST_STREAM with error code: CANCEL&#34; host=&#34;localhost:8000&#34; method=GET operation_id=OtfDiff params=&#34;{TablePaths:{Left:{Ref:data_load@ Path:aggs/agg_variety/} Right:{Ref:data_load Path:aggs/agg_variety/} Base:{Ref: Path:}} S3Creds:{Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Endpoint:http://0.0.0.0:8000} Repo:example}&#34; path=&#34;/api/v1/repositories/example/otf/refs/data_load%40/diff/data_load?table_path=aggs%2Fagg_variety%2F&amp;type=delta&#34; request_id=d3b6fdc7-2544-4c12-8e05-376f16e35a80 service_name=rest_api type=delta user=docker

Discovered when investigating #5862

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

disable all logging?

References

Are there any links users can visit to find out more?

Which versions are affected by GHSA-4rgc-5g6r-2rjf?

3 open source packages ship an affected version, including github.com/treeverse/lakefs.

Package	Affected	Fixed in
`github.com/treeverse/lakefs` Go	All versions	`0.101.0`
`github.com/treeverse/lakefs` Go	All versions	`0.101.0`
`github.com/treeverse/lakefs` Go	All versions	`0.101.0`

How do I fix GHSA-4rgc-5g6r-2rjf?

Upgrade github.com/treeverse/lakefs to 0.101.0 or later.

Is GHSA-4rgc-5g6r-2rjf being exploited?

There is no known exploitation of GHSA-4rgc-5g6r-2rjf in the wild and no public exploit code.

Sources

Also known as GO-2023-2398.