Atlantis <0.30.0 Log Credential Exposure Vulnerability (CVE-2024-52009)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Git credentials are exposed in atlantis logs - Severity: High - Publisher: jamengual - CVE ID: CVE-2024-52009 - Affected Versions: <0.30.0 - Fixed Version: 0.30.0 2. Vulnerability Details: - Summary: When Atlantis logs contain GitHub credentials (tokens), these credentials are readable on GitHub, allowing attackers to read the logs and impersonate the Atlantis application to perform actions on GitHub. - Impact: When Atlantis is used to manage GitHub organizations, attackers can gain administrative privileges over the organization. - Fix: This issue was reported in #4060 and #4667 and was fixed in Atlantis v0.30.0. 3. Vulnerability Impact: - Sensitive Information Leakage: GitHub credentials are leaked in log files. - Attacker Privileges: Attackers can read the logs and impersonate the Atlantis application to perform actions on GitHub. - Organization Administrative Access: Attackers can gain administrative access to GitHub organizations. 4. Exploitation: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 5. Exploitation Method: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 6. Exploitation Tools: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 7. Exploitation Example: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 8. Exploitation Impact: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 9. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 10. Exploitation Severity: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 11. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 12. Exploitation Severity: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 13. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 14. Exploitation Severity: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 15. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 16. Exploitation Severity: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 17. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 18. Exploitation Severity: - Credential Leakage: Credentials are leaked in log files. - Credential Reading: Credentials are readable on GitHub. - Credential Usage: Credentials are used to impersonate the Atlantis application and perform actions on GitHub. 19. Exploitation Scope: - Credential Leakage: Credentials are leaked in log files. - Credential

Goal Reached Thanks to every supporter — we hit 100%!

Atlantis <0.30.0 Log Credential Exposure Vulnerability (CVE-2024-52009)

More from this source