CVE-2024-28236: Insufficient Information (NVD-CWE-noinfo)
value: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. **To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive. While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security. This issue has been addressed in version 0.23.2. Users are advised to upgrade. Users unable to upgrade should not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values, ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive, minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process, make use of the build approval setting, restricting builds from untrusted users, and limit use of shared secrets, as they are less restrictive to access by nature.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-12T21:15Z
Repository: https://github.com/go-vela/worker
Language: Go
Files changed: executor/linux/build.go, executor/linux/linux.go, executor/linux/secret.go, executor/linux/service.go, executor/linux/step.go, go.mod, go.sum
Commit date: 2024-03-12 13:53:33 -0500
Commit message: Merge pull request from GHSA-pwx5-6wxg-px5h

* fix(secrets): split env injection based on allow_substitution value

* upgrade sdk server and types
Diff: diff --git a/executor/linux/build.go b/executor/linux/build.go
index 0fb2337..eca0623 100644
--- a/executor/linux/build.go
+++ b/executor/linux/build.go
@@ -197,12 +197,16 @@ func (c *client) PlanBuild(ctx context.Context) error {
 			return fmt.Errorf("unable to decode secret: %w", err)
 		}
 
 		_log.AppendData(append(sRaw, "\n"...))
 
-		// add secret to the map
-		c.Secrets[secret.Name] = s
+		// add secret to the appropriate map
+		if s.GetAllowSubstitution() {
+			c.Secrets[secret.Name] = s
+		} else {
+			c.NoSubSecrets[secret.Name] = s
+		}
 	}
 
 	// escape newlines in secrets loaded on build_start
 	escapeNewlineSecrets(c.Secrets)
 
@@ -697,10 +701,11 @@ func (c *client) StreamBuild(ctx context.Context) error {
 // during build planning. It is only available for the Docker runtime.
 func loadLazySecrets(c *client, _step *pipeline.Container) error {
 	_log := new(library.Log)
 
 	lazySecrets := make(map[string]*library.Secret)
+	lazyNoSubSecrets := make(map[string]*library.Secret)
 
 	// this requires a small preface and brief description on
 	// how normal secrets make it into a container:
 	//
 	// 1. pull secrets
@@ -795,12 +800,16 @@ func loadLazySecrets(c *client, _step *pipeline.Container) error {
 			_, err = c.Vela.Log.UpdateStep(c.repo.GetOrg(), c.repo.GetName(), c.build.GetNumber(), _step.Number, _log)
 			if err != nil {
 				return err
 			}
 
-			// add secret to the temp map
-			lazySecrets[secret.Name] = s
+			// add secret to the appropriate temp map
+			if s.GetAllowSubstitution() {
+				lazySecrets[secret.Name] = s
+			} else {
+				lazyNoSubSecrets[secret.Name] = s
+			}
 		}
 	}
 
 	// if we had lazy secrets, get them into the container
 	if len(lazySecrets) > 0 {
@@ -834,10 +843,17 @@ func loadLazySecrets(c *client, _step *pipeline.Container) error {
 		err = tmpStep.Substitute()
 		if err != nil {
 			return err
 		}
 
+		c.Logger.Debug("injecting no-sub lazy loaded secrets")
+		// inject secrets for container
+		err = injectSecrets(tmpStep, lazyNoSubSecrets)
+		if err != nil {
+			return err
+		}
+
 		c.Logger.Debug("merge lazy loaded secrets into container")
 		// merge lazy load secrets into original container
 		err = _step.MergeEnv(tmpStep.Environment)
 		if err != nil {
 			return fmt.Errorf("failed to merge environment")
diff --git a/executor/linux/linux.go b/executor/linux/linux.go
index 726c698..dac4ede 100644
--- a/executor/linux/linux.go
+++ b/executor/linux/linux.go
@@ -17,16 +17,17 @@ import (
 
 type (
 	// client manages communication with the pipeline resources.
 	client struct {
 		// https://pkg.go.dev/github.com/sirupsen/logrus#Entry
-		Logger   *logrus.Entry
-		Vela     *vela.Client
-		Runtime  runtime.Engine
-		Secrets  map[string]*library.Secret
-		Hostname string
-		Version  string
+		Logger       *logrus.Entry
+		Vela         *vela.Client
+		Runtime      runtime.Engine
+		Secrets      map[string]*library.Secret
+		NoSubSecrets map[string]*library.Secret
+		Hostname     string
+		Version      string
 
 		// clients for build actions
 		secret *secretSvc
 
 		// private fields
@@ -65,10 +66,11 @@ func Equal(a, b *client) bool {
 
 	return reflect.DeepEqual(a.Logger, b.Logger) &&
 		reflect.DeepEqual(a.Vela, b.Vela) &&
 		reflect.DeepEqual(a.Runtime, b.Runtime) &&
 		reflect.DeepEqual(a.Secrets, b.Secrets) &&
+		reflect.DeepEqual(a.NoSubSecrets, b.NoSubSecrets) &&
 		a.Hostname == b.Hostname &&
 		a.Version == b.Version &&
 		reflect.DeepEqual(a.init, b.init) &&
 		a.maxLogSize == b.maxLogSize &&
 		reflect.DeepEqual(a.privilegedImages, b.privilegedImages) &&
@@ -116,10 +118,13 @@ func New(opts ...Opt) (*client, error) {
 	}
 
 	// instantiate map for non-plugin secrets
 	c.Secrets = make(map[string]*library.Secret)
 
+	// instantiate map for non-substituted secrets
+	c.NoSubSecrets = make(map[string]*library.Secret)
+
 	// instantiate all client services
 	c.secret = &secretSvc{client: c}
 
 	return c, nil
 }
diff --git a/executor/linux/secret.go b/executor/linux/secret.go
index f9874d3..17759d8 100644
--- a/executor/linux/secret.go
+++ b/executor/linux/secret.go
@@ -65,10 +65,17 @@ func (s *secretSvc) create(ctx context.Context, ctn *pipeline.Container) error {
 	err = ctn.Substitute()
 	if err != nil {
 		return fmt.Errorf("unable to substitute container configuration")
 	}
 
+	logger.Debug("injecting non-substituted secrets")
+	// inject no-substitution secrets for container
+	err = injectSecrets(ctn, s.client.NoSubSecrets)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
 // destroy cleans up secret plugin after execution.
 func (s *secretSvc) destroy(ctx context.Context, ctn *pipeline.Container) error {
diff --git a/executor/linux/service.go b/executor/linux/service.go
index 22ea926..7ba8246 100644
--- a/executor/linux/service.go
+++ b/executor/linux/service.go
@@ -53,10 +53,17 @@ func (c *client) CreateService(ctx context.Context, ctn *pipeline.Container) err
 	err = ctn.Substitute()
 	if err != nil {
 		return fmt.Errorf("unable to substitute container configuration")
 	}
 
+	logger.Debug("injecting non-substituted secrets")
+	// inject no-substitution secrets for container
+	err = injectSecrets(ctn, c.NoSubSecrets)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
 // PlanService prepares the service for execution.
 func (c *client) PlanService(ctx context.Context, ctn *pipeline.Container) error {
diff --git a/executor/linux/step.go b/executor/linux/step.go
index c34dbd8..a272784 100644
--- a/executor/linux/step.go
+++ b/executor/linux/step.go
@@ -63,10 +63,17 @@ func (c *client) CreateStep(ctx context.Context, ctn *pipeline.Container) error
 	err = ctn.Substitute()
 	if err != nil {
 		return fmt.Errorf("unable to substitute container configuration")
 	}
 
+	logger.Debug("injecting non-substituted secrets")
+	// inject no-substitution secrets for container
+	err = injectSecrets(ctn, c.NoSubSecrets)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
 // PlanStep prepares the step for execution.
 func (c *client) PlanStep(ctx context.Context, ctn *pipeline.Container) error {
diff --git a/go.mod b/go.mod
index 0c0de72..9ae8786 100644
--- a/go.mod
+++ b/go.mod
@@ -6,13 +6,13 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/distribution/reference v0.5.0
 	github.com/docker/docker v24.0.9+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/gin-gonic/gin v1.9.1
-	github.com/go-vela/sdk-go v0.23.1
-	github.com/go-vela/server v0.23.1
-	github.com/go-vela/types v0.23.1
+	github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf
+	github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d
+	github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe
 	github.com/golang-jwt/jwt/v5 v5.2.0
 	github.com/google/go-cmp v0.6.0
 	github.com/joho/godotenv v1.5.1
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/prometheus/client_golang v1.18.0
diff --git a/go.sum b/go.sum
index 43c234f..e00b6af 100644
--- a/go.sum
+++ b/go.sum
@@ -92,16 +92,16 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
 github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
-github.com/go-vela/sdk-go v0.23.1 h1:4KxfAF1vR8DvtRraBoWQDIm8f8zxXP806lJR3MmTlC8=
-github.com/go-vela/sdk-go v0.23.1/go.mod h1:zDsZIePtBdpCZwmwAWqGWuIch/oGliX1zd51PARTHBk=
-github.com/go-vela/server v0.23.1 h1:Y+mGfB79RjIgQ3IEkPjGB6IneB2So3ZXE4XKY+Z02xc=
-github.com/go-vela/server v0.23.1/go.mod h1:B+A5lRPOlAVYyXBMGCAJKhPQOlfJuWl3qaRcvhsUqSA=
-github.com/go-vela/types v0.23.1 h1:st4BeDcYVyaaFqblU1YroztNvmYLBgmfZpWq0En0Sg0=
-github.com/go-vela/types v0.23.1/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
+github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf h1:8Oka4tMHOdy/DsInyg7c/XPY5wqWWE7Yvzx/u67WBuw=
+github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf/go.mod h1:XjrVfIDw2SZDFBtJ5vqVse/GFj89MF542N20P8U5a3I=
+github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d h1:VynpkAIMt3KTh9BaICQdpu6c76/hHU3d4/Ab44bmFew=
+github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d/go.mod h1:EsDVTqQHQ9snXG2DhUl9uo4+Cf/b9nMiESCkxSjmP90=
+github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe h1:Fb28yre0nrX1GNeyPN8i8rruTlW8MnPVF3Fo5xTuOkg=
+github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=

Vulnerable code: 		// add secret to the map
		c.Secrets[secret.Name] = s
			// add secret to the temp map
			lazySecrets[secret.Name] = s
		Logger   *logrus.Entry
		Vela     *vela.Client
		Runtime  runtime.Engine
		Secrets  map[string]*library.Secret
		Hostname string
		Version  string
	github.com/go-vela/sdk-go v0.23.1
	github.com/go-vela/server v0.23.1
	github.com/go-vela/types v0.23.1
github.com/go-vela/sdk-go v0.23.1 h1:4KxfAF1vR8DvtRraBoWQDIm8f8zxXP806lJR3MmTlC8=
github.com/go-vela/sdk-go v0.23.1/go.mod h1:zDsZIePtBdpCZwmwAWqGWuIch/oGliX1zd51PARTHBk=
github.com/go-vela/server v0.23.1 h1:Y+mGfB79RjIgQ3IEkPjGB6IneB2So3ZXE4XKY+Z02xc=
github.com/go-vela/server v0.23.1/go.mod h1:B+A5lRPOlAVYyXBMGCAJKhPQOlfJuWl3qaRcvhsUqSA=
github.com/go-vela/types v0.23.1 h1:st4BeDcYVyaaFqblU1YroztNvmYLBgmfZpWq0En0Sg0=
github.com/go-vela/types v0.23.1/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
Fixed code: 		// add secret to the appropriate map
		if s.GetAllowSubstitution() {
			c.Secrets[secret.Name] = s
		} else {
			c.NoSubSecrets[secret.Name] = s
		}
	lazyNoSubSecrets := make(map[string]*library.Secret)
			// add secret to the appropriate temp map
			if s.GetAllowSubstitution() {
				lazySecrets[secret.Name] = s
			} else {
				lazyNoSubSecrets[secret.Name] = s
			}
		c.Logger.Debug("injecting no-sub lazy loaded secrets")
		// inject secrets for container
		err = injectSecrets(tmpStep, lazyNoSubSecrets)
		if err != nil {
			return err
		}

		Logger       *logrus.Entry
		Vela         *vela.Client
		Runtime      runtime.Engine
		Secrets      map[string]*library.Secret
		NoSubSecrets map[string]*library.Secret
		Hostname     string
		Version      string
		reflect.DeepEqual(a.NoSubSecrets, b.NoSubSecrets) &&
	// instantiate map for non-substituted secrets
	c.NoSubSecrets = make(map[string]*library.Secret)

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, s.client.NoSubSecrets)
	if err != nil {
		return err
	}

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, c.NoSubSecrets)
	if err != nil {
		return err
	}

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, c.NoSubSecrets)
	if err != nil {
		return err
	}

	github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf
	github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d
	github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf h1:8Oka4tMHOdy/DsInyg7c/XPY5wqWWE7Yvzx/u67WBuw=
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf/go.mod h1:XjrVfIDw2SZDFBtJ5vqVse/GFj89MF542N20P8U5a3I=
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d h1:VynpkAIMt3KTh9BaICQdpu6c76/hHU3d4/Ab44bmFew=
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d/go.mod h1:EsDVTqQHQ9snXG2DhUl9uo4+Cf/b9nMiESCkxSjmP90=
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe h1:Fb28yre0nrX1GNeyPN8i8rruTlW8MnPVF3Fo5xTuOkg=
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=