Arcane Missing Admin Authorization on Git Endpoints Leads to Credential Exfiltration (CVE-2024-45425)

Vulnerability Overview Title: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs Description: Arcane’s web-based REST API exposes eight new endpoints under and to manage GitOps source repositories and their stored credentials. None of these eight endpoints ( , , , , , , , ) invoke the helper function, meaning that user permission checks typically applied to other admin resources (such as container registries, environments, users, API keys, clusters, settings, system, notifications, and events) are intentionally bypassed. Consequently, any authenticated user can list, create, modify, delete, and test Git repository configurations. By pointing an existing repository’s URL to a server controlled by the attacker, the attacker can decrypt valid PATs/SSH keys and send them to their server as HTTP Basic auth (or SSH key auth), thereby stealing plaintext Git credentials in a single action. Impact Scope Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-45425 Weakness: CWE-862 Credit: @Tset Remediation Patch Version: POC Code Summary This vulnerability allows non-admin users to steal stored Git credentials (PATs and SSH keys) and potentially compromise GitOps configurations by tampering with Git repository configurations. The remediation is to upgrade to version .

Goal Reached Thanks to every supporter — we hit 100%!

Arcane Missing Admin Authorization on Git Endpoints Leads to Credential Exfiltration (CVE-2024-45425)

More from this source