apko Exposure of HTTP basic auth credentials in log output
Date: 2024-06
Affected: go/chainguard.dev/apko
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-36127
CWE: CWE-522
CWE-532
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

### Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output ### Details There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL. 2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow. apko, as well as its companion library `go-apk`, have been updated to ensure URLs are parsed and redacted before being output as string values. ### PoC Create a config file like this `apko.yaml`: ```yaml contents: keyring: - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub repositories: - https://me%40example.com:supersecretpassword@localhost:8080/os packages: - wolfi-base cmd: /bin/sh -l archs: - x86_64 - aarch64 ``` Then run: ```shell apko build apko.yaml latest foo.tar --log-level debug ``` Observe instances of the password being shown verbatim in the log output, such as: ```text ... DEBU image configuration: contents: repositories: - https://me%40example.com:supersecretpassword@localhost:8080/os keyring: - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub packages:


Mitigations:

Architectural layers (MAESTRO):