CVE-2021-3684: Insertion of Sensitive Information into Log File (CWE-532)
value: A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 5.5
Published: 2023-03-24T20:15Z
Repository: https://github.com/openshift/assisted-installer
Language: Go
Files changed: src/assisted_installer_controller/assisted_installer_controller.go, src/ops/ops.go
Commit date: 2021-08-05 09:40:56 +0000
Commit message: MGMT-7452: Remove token from assisted-installer-controller log (#338)


Diff: diff --git a/src/assisted_installer_controller/assisted_installer_controller.go b/src/assisted_installer_controller/assisted_installer_controller.go
index f6e268f..e1ed794 100644
--- a/src/assisted_installer_controller/assisted_installer_controller.go
+++ b/src/assisted_installer_controller/assisted_installer_controller.go
@@ -68,13 +68,13 @@ var (
 // assisted installer controller is added to control installation process after  bootstrap pivot
 // assisted installer will deploy it on installation process
 // as a first step it will wait till nodes are added to cluster and update their status to Done
 
 type ControllerConfig struct {
-	ClusterID             string `envconfig:"CLUSTER_ID" required:"true" `
+	ClusterID             string `envconfig:"CLUSTER_ID" required:"true"`
 	URL                   string `envconfig:"INVENTORY_URL" required:"true"`
-	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true"`
+	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true" secret:"true"`
 	SkipCertVerification  bool   `envconfig:"SKIP_CERT_VERIFICATION" required:"false" default:"false"`
 	CACertPath            string `envconfig:"CA_CERT_PATH" required:"false" default:""`
 	Namespace             string `envconfig:"NAMESPACE" required:"false" default:"assisted-installer"`
 	OpenshiftVersion      string `envconfig:"OPENSHIFT_VERSION" required:"true"`
 	HighAvailabilityMode  string `envconfig:"HIGH_AVAILABILITY_MODE" required:"false" default:"Full"`
diff --git a/src/ops/ops.go b/src/ops/ops.go
index 6d0e22b..ee8b66a 100644
--- a/src/ops/ops.go
+++ b/src/ops/ops.go
@@ -236,11 +236,11 @@ func (o *ops) SetBootOrder(device string) error {
 	}
 	return nil
 }
 
 func (o *ops) ExtractFromIgnition(ignitionPath string, fileToExtract string) error {
-	o.log.Infof("Getting pull secret from %s", ignitionPath)
+	o.log.Infof("Getting data from %s", ignitionPath)
 	ignitionData, err := ioutil.ReadFile(ignitionPath)
 	if err != nil {
 		o.log.Errorf("Error occurred while trying to read %s : %e", ignitionPath, err)
 		return err
 	}

Vulnerable code: 	ClusterID             string `envconfig:"CLUSTER_ID" required:"true" `
	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true"`
	o.log.Infof("Getting pull secret from %s", ignitionPath)
Fixed code: 	ClusterID             string `envconfig:"CLUSTER_ID" required:"true"`
	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true" secret:"true"`
	o.log.Infof("Getting data from %s", ignitionPath)