Impact

When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires.

Patches

This vulnerability was fixed in source-controller v1.2.5.

Workarounds

There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.

Credits

This issue was reported and fixed by Jagpreet Singh Tamber (@jagpreetstamber) from the Azure Arc team.

References

fluxcd/source-controller#1430

For more information

If you have any questions or comments about this advisory:

• Open an issue in the source-controller repository.
• Contact us at the CNCF Flux Channel.

References

• GHSA-v554-xwgw-hc3w
• fluxcd/source-controller#1430
• fluxcd/source-controller@915d1a0
• https://nvd.nist.gov/vuln/detail/CVE-2024-31216