CVE-2023-39348

Improper log output when using GitHub Status Notifications in spinnaker

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the risk is slightly higher than a "low" since token exposure could grant elevated access to repositories outside of control. If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads. This only affects users of GitHub Status Notifications. This issue has been addressed in pull request 1316. Users are advised to upgrade. Users unable to upgrade should disable GH Status Notifications, Filter their logs for Echo log data and use read-only tokens that are limited in scope.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-07-28 CVE Reserved
2023-08-28 CVE Published
2024-08-02 CVE Updated
2024-09-03 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-532: Insertion of Sensitive Information into Log File

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/spinnaker/echo/pull/1316	2023-09-01

URL	Date	SRC
https://github.com/spinnaker/spinnaker/security/advisories/GHSA-rq5c-hvw6-8pr7	2023-09-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linuxfoundation Search vendor "Linuxfoundation"		Spinnaker Search vendor "Linuxfoundation" for product "Spinnaker"				< 1.28.8 Search vendor "Linuxfoundation" for product "Spinnaker" and version " < 1.28.8"		-		Affected
Linuxfoundation Search vendor "Linuxfoundation"		Spinnaker Search vendor "Linuxfoundation" for product "Spinnaker"				>= 1.29.0 < 1.29.6 Search vendor "Linuxfoundation" for product "Spinnaker" and version " >= 1.29.0 < 1.29.6"		-		Affected
Linuxfoundation Search vendor "Linuxfoundation"		Spinnaker Search vendor "Linuxfoundation" for product "Spinnaker"				>= 1.30.0 < 1.30.3 Search vendor "Linuxfoundation" for product "Spinnaker" and version " >= 1.30.0 < 1.30.3"		-		Affected
Linuxfoundation Search vendor "Linuxfoundation"		Spinnaker Search vendor "Linuxfoundation" for product "Spinnaker"				1.30.0 Search vendor "Linuxfoundation" for product "Spinnaker" and version "1.30.0"		-		Affected