Git credentials are exposed in Atlantis logs
Date: 2024-11
Affected: go/github.com/runatlantis/atlantis
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-52009
CWE: CWE-532

### Summary _Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._ Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in https://github.com/runatlantis/atlantis/issues/4060 and fixed in https://github.com/runatlantis/atlantis/pull/4667 . The fix was included in [Atlantis v0.30.0](https://github.com/runatlantis/atlantis/releases/tag/v0.30.0). ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ While auditing the Kubernetes/Argo CD/Atlantis deployment of some company, the following set-up was encountered: - Most employees have read-only access to Argo CD, enabling them to see the health of deployed applications. - Atlantis was deployed as an Argo CD application. - Atlantis was used to manage the configuration of a GitHub organization (such as team members), using [Terraform's GitHub integration](https://registry.terraform.io/providers/integrations/github/latest). Atlantis logs on Argo CD contained lines such as: ```json {"level":"debug","ts":"2024-11-


Mitigations:

Architectural layers (MAESTRO):