Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-23538— User credentials leaked to third-party service via HTTP redirect in scs-library-client

Quick assessment

Affected
sylabs scs-library-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SCS Library Client是Singularity Container Services (SCS)的Golang客户端。 SCS Library Client 存在安全漏洞。攻击者利用该漏洞可以执行多部分并发下载。

CVSS 5.2 · Medium EPSS 0.71% · P52

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-23538

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
User credentials leaked to third-party service via HTTP redirect in scs-library-client
Source: CVE Program / CVE List V5
Vulnerability Description
github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
SCS Library Client 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SCS Library Client是Singularity Container Services (SCS)的Golang客户端。 SCS Library Client 存在安全漏洞。攻击者利用该漏洞可以执行多部分并发下载。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
sylabs scs-library-client < 1.34 -

II. Public POCs for CVE-2022-23538

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-23538

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-23538 (2)

Vendor Advisories for CVE-2022-23538 (1)

IV. Related Vulnerabilities

Same vendor: sylabs
Same weakness: CWE-522

V. Comments for CVE-2022-23538

No comments yet

Leave a comment