CVE-2024-52009
This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CVSS 4.0
- 8.5 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- runatlantis/atlantis
- Source
- security-advisories@github.com
References
- https://argo-cd.readthedocs.io/en/stable/operator-manual/securityTechnical Description
- https://github.com/runatlantis/atlantis/issues/4060Issue Tracking
- https://github.com/runatlantis/atlantis/pull/4667Issue Tracking
- https://github.com/runatlantis/atlantis/releases/tag/v0.30.0Release Notes
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rpExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.