Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yNmhyLXEyd3AtcnZjNc4AA3q9

User with permission to write actions can impersonate another user when auth token is configured in environment variable

Impact

When lakeFS is configured with ALL of the following:

• Configuration option auth.encrypt.secret_key passed through environment variable
• Actions enabled via configuration option actions.enabled (default enabled)

then a user who can configure an action can impersonate any other user.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

ANY ONE of these is sufficient to prevent the issue:

• Do not pass auth.encrypt.secret_key through an environment variable.

  For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.

• Disable actions.

• Limit users allowed to configure actions.

Permalink: https://github.com/advisories/GHSA-26hr-q2wp-rvc5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNmhyLXEyd3AtcnZjNc4AA3q9
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 5 months ago

CVSS Score: 6.2
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Identifiers: GHSA-26hr-q2wp-rvc5
References:

• https://github.com/treeverse/lakeFS/security/advisories/GHSA-26hr-q2wp-rvc5
• https://github.com/advisories/GHSA-26hr-q2wp-rvc5

Repository: https://github.com/treeverse/lakeFS
Blast Radius: 0.0

Affected Packages