User with permission to write actions can impersonate another user when auth token is configured in environment variable

MEDIUM 6.2GHSA-26hr-q2wp-rvc5 · GO-2023-2397 · Published 12/12/2023 · updated 21/08/2024

In short

GHSA-26hr-q2wp-rvc5 is a MEDIUM (CVSS 6.2) vulnerability affecting github.com/treeverse/lakefs.
Fix: update to 1.3.1 or later.

Package	Affected versions	Patched versions
github.com/treeverse/lakefs Go	`< 1.3.1`	`1.3.1`

When lakeFS is configured with ALL of the following:

Configuration option auth.encrypt.secret_key passed through environment variable
Actions enabled via configuration option actions.enabled (default enabled)

then a user who can configure an action can impersonate any other user.

Has the problem been patched? What versions should users upgrade to?

ANY ONE of these is sufficient to prevent the issue:

Do not pass auth.encrypt.secret_key through an environment variable.

For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.3.1

1.3.1

Description

When lakeFS is configured with ALL of the following:

Configuration option auth.encrypt.secret_key passed through environment variable
Actions enabled via configuration option actions.enabled (default enabled)

then a user who can configure an action can impersonate any other user.

Has the problem been patched? What versions should users upgrade to?

ANY ONE of these is sufficient to prevent the issue:

Do not pass auth.encrypt.secret_key through an environment variable.

For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.

More vulnerabilities in github.com/treeverse/lakefs

See all →