CVE-2021-32074: Vault GitHub Action Multi-line Secret Leakage
Summary
CVE-2021-32074: Vault GitHub Action did not correctly mask multi-line secrets in output. Affects hashicorp/vault-action versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HashiCorp vault-action, also known as Vault GitHub Action, is a tool used in GitHub Actions workflows to interact with HashiCorp Vault. It allows users to securely manage and retrieve secrets from Vault during their CI/CD pipelines. This vulnerability affects versions prior to 2.2.0 of the vault-action package.
Vulnerability Detail
The vault-action implementation did not correctly handle the masking of multi-line secrets in its output. This flaw could be exploited by attackers to obtain sensitive information from log files. When a multi-line secret was not correctly registered with GitHub Actions for log masking, it would be exposed in the vault-action output. This could lead to the exposure of confidential data and potential compromise of the application or system.
How To Fix
Minimum fixed version
2.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by upgrading to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in the HashiCorp vault-action package allows attackers to obtain sensitive information from log files. Upgrading to version 2.2.0 or newer of the package is the recommended solution to mitigate this risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for hashicorp/vault-action →
FAQ
This vulnerability allows attackers to obtain sensitive information from log files, potentially leading to the exposure of confidential data and compromise of the application or system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
There is no specific mention of a known exploit for this vulnerability. However, it is recommended to upgrade to the fixed version to mitigate the risk.
The recommended solution is to upgrade to vault-action version 2.2.0 or newer. There are no alternative solutions mentioned for this vulnerability.
