High, CVSS 7.7GoPublished
Types for Vela Insecure Variable Substitution
GHSA-7v38-w32m-wx4m
- Affected
- Go github.com/go-vela/types <= 0.23.1
- Fixed in
- 0.23.2· Vendor fix available
- Issue
- Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. Given by the following substitution examples: using parameters using image tag using entrypoint as a shim for commands To exploit this the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as…
Recommended action: Upgrade to 0.23.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.