Project

General

Profile

Actions
Copy link

Bug #31938

closed

CVE-2021-3413 Azure compute resource secret_key leak to authenticated users

Added by Evgeni Golov over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Evgeni Golov
Category:
General Plugin Issues
Target version:
2.2.0
Difficulty:
Triaged:
Yes
Bugzilla link:
1928786
Pull request:
https://github.com/theforeman/foreman_azure_rm/pull/103
Fixed in Releases:
2.2.0
Found in Releases:
Red Hat JIRA:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1928786

authenticated users can acquire credentials of compute resources

  1. prerequisites

- user with the view_compute_resources permission (e.g. like granted by the "Viewers" role)
- Azure RM compute resource configured

  1. tested environment

Foreman 2.1 with Azure RM compute resource

  1. leak

When the `/api/compute_resources/:id/` API endpoint is accessed, it contains the secret_key of the Azure RM user (also the tenant, app_ident etc data that is required to connect, but I think secret_key is the only secret here).

Version-Release number of selected component (if applicable):
2.1 with Azure RM plugin

How reproducible:
100%

Steps to Reproduce:
1. access /api/compute_resources/:id/
2. see credentials in the JSON

Actual results:
JSON contains "secret_key":"THE_KEY"

Expected results:
JSON doesn\'t contain the "secret_key" entry

Additional info:'

Actions
Copy link

Also available in: Atom PDF