GHSA-vmcp-66r5-3pcp
Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error
Quick fix
GHSA-vmcp-66r5-3pcp — Steeltoe.Discovery.Eureka: upgrade to the fixed version with the command below.
dotnet add package Steeltoe.Discovery.Eureka --version 3.2.8Details
### Summary When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.
### Details Package: Steeltoe.Discovery.Eureka Package version: 3.2.1 Branch: "release/3.2" File name: `DiscoveryClient.cs` Line number: 325 Code in question: `_logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());`
Error message in logs: `FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:password@eureka2.com:443/eureka`
I thought `new Uri(clientOptions.EurekaServerServiceUrls)` would throw a `UriFormatException` since there are multiple URLs but my logs are showing two URLs regardless.
### PoC 1. Set Eureka config with multiple server URLs with basic auth 2. Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in `FetchFullRegistryAsync`. 3. Check the logs and should see the error
### Impact Vulnerability: Credential leakage in the logs Who does it impact?: Users who are using peer awareness with Spring Eureka
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 3.2.8dotnet add package Steeltoe.Discovery.Eureka --version 3.2.80No fixed version published yet for Steeltoe.Discovery.EurekaBase (nuget). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for Steeltoe.Discovery.ClientCore (nuget). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for Steeltoe.Discovery.ClientAutofac (nuget). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-40636[ADVISORY]
- https://github.com/SteeltoeOSS/Steeltoe/commit/c5d4a94e90ccb77f8e851bc681a2e348a95e7ecb[WEB]
- https://github.com/SteeltoeOSS/security-advisories[PACKAGE]