CVE-2021-3413 Azure compute resource secret_key leak to authenticated users
authenticated users can acquire credentials of compute resources
- user with the view_compute_resources permission (e.g. like granted by the "Viewers" role)
- Azure RM compute resource configured
- tested environment
Foreman 2.1 with Azure RM compute resource
When the `/api/compute_resources/:id/` API endpoint is accessed, it contains the secret_key of the Azure RM user (also the tenant, app_ident etc data that is required to connect, but I think secret_key is the only secret here).
Version-Release number of selected component (if applicable):
2.1 with Azure RM plugin
Steps to Reproduce:
1. access /api/compute_resources/:id/
2. see credentials in the JSON
JSON contains "secret_key":"THE_KEY"
JSON doesn\'t contain the "secret_key" entry
#2 Updated by Evgeni Golov 5 months ago
- Status changed from New to Closed
Applied in changeset foreman_azure_rm|ccdff90e9c2497af3114c686571bdbad91f1a6bd.
#3 Updated by Chris Roberts 4 months ago
- Triaged changed from No to Yes
- Target version set to 2.2.0
- Category set to General Plugin Issues
- Subject changed from CVE-2021-3413 Azure compute resource secret_key leak to authenticated users to CVE-2021-3413 Azure compute resource secret_key leak to authenticated users