Impact
A vulnerability has been identified in the NeuVector version up to and including 5.4.4, where sensitive information is leaked into the manager container’s log. The listed fields can be caught in the log:
| Field |
Field Description |
Where it Appears |
Reproduction |
Environment |
X-R-Sess |
Rancher’s session token for single sign on token |
Request header |
Log in via Rancher UI and access NeuVector SSO |
Rancher with NeuVector SSO |
personal_access_token |
The Github / Azure DevOps token |
Request body |
Submit remote repository config under Configuration > Settings |
NeuVector |
token1.token |
NeuVector user’s session token |
Response body |
Send GET request through NeuVector web server’s API: https://<neuvector ui’s url>/user?name=<username> |
NeuVector |
rekor_public_key, root_cert, sct_public_key |
Rekor public key, Root certificate, Signed certificate timestamp(SCT) Public Key in private root of trust |
Request body |
Create/update private root of trust from Sigstore page |
NeuVector |
public_key |
Verifier’s public key |
Request body |
Create/update verifier in Sigstore page |
NeuVector |
Note:
-
In the patched version, X-R-Sess is partially masked so that users can confirm what it is being used while still keeping it safe for consumption. The log which includes personal_access_token, token, rekor_public_key, root_cert, sct_public_key, public key are removed, as the request body is not mandatory in the log.
-
The exploitability of the vulnerability depends on your logging strategy.
- Local logging (default): Limits exposure of impact.
- External logging: Vulnerability’s severity increases, the impact depends on security measures implemented at the external log collector level.
Please consult the associated Unsecured credentials for further information about this category of attack.
Patches
Patched versions include release 5.4.5 and above. Users are advised to rotate the GitHub token used in Remote Repository Configuration once they have upgraded to a fixed version.
Workarounds
No workarounds are currently available. Customers are advised to upgrade to a fixed version at their earliest convenience.
References
If you have any questions or comments about this advisory:
Impact
A vulnerability has been identified in the NeuVector version up to and including
5.4.4, where sensitive information is leaked into the manager container’s log. The listed fields can be caught in the log:X-R-Sesspersonal_access_tokentoken1.tokenhttps://<neuvector ui’s url>/user?name=<username>rekor_public_key,root_cert,sct_public_keypublic_keyNote:
In the patched version, X-R-Sess is partially masked so that users can confirm what it is being used while still keeping it safe for consumption. The log which includes
personal_access_token,token,rekor_public_key,root_cert,sct_public_key,public keyare removed, as the request body is not mandatory in the log.The exploitability of the vulnerability depends on your logging strategy.
Please consult the associated Unsecured credentials for further information about this category of attack.
Patches
Patched versions include release
5.4.5and above. Users are advised to rotate the GitHub token used in Remote Repository Configuration once they have upgraded to a fixed version.Workarounds
No workarounds are currently available. Customers are advised to upgrade to a fixed version at their earliest convenience.
References
If you have any questions or comments about this advisory: