CVE-2024-28236 (Go, published 2024-03-12T21:15Z)
Description: value: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. **To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive. While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security. This issue has been addressed in version 0.23.2. Users are advised to upgrade. Users unable to upgrade should not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values, ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive, minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process, make use of the build approval setting, restricting builds from untrusted users, and limit use of shared secrets, as they are less restrictive to access by nature.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/go-vela/worker
Files changed:
executor/linux/build.go
executor/linux/linux.go
executor/linux/secret.go
executor/linux/service.go
executor/linux/step.go
go.mod
go.sum
Commit message: Merge pull request from GHSA-pwx5-6wxg-px5h

* fix(secrets): split env injection based on allow_substitution value

* upgrade sdk server and types

Vulnerable code:
		// add secret to the map
		c.Secrets[secret.Name] = s
			// add secret to the temp map
			lazySecrets[secret.Name] = s
		Logger   *logrus.Entry
		Vela     *vela.Client
		Runtime  runtime.Engine
		Secrets  map[string]*library.Secret
		Hostname string
		Version  string
	github.com/go-vela/sdk-go v0.23.1
	github.com/go-vela/server v0.23.1
	github.com/go-vela/types v0.23.1
github.com/go-vela/sdk-go v0.23.1 h1:4KxfAF1vR8DvtRraBoWQDIm8f8zxXP806lJR3MmTlC8=
github.com/go-vela/sdk-go v0.23.1/go.mod h1:zDsZIePtBdpCZwmwAWqGWuIch/oGliX1zd51PARTHBk=
github.com/go-vela/server v0.23.1 h1:Y+mGfB79RjIgQ3IEkPjGB6IneB2So3ZXE4XKY+Z02xc=
github.com/go-vela/server v0.23.1/go.mod h1:B+A5lRPOlAVYyXBMGCAJKhPQOlfJuWl3qaRcvhsUqSA=
github.com/go-vela/types v0.23.1 h1:st4BeDcYVyaaFqblU1YroztNvmYLBgmfZpWq0En0Sg0=
github.com/go-vela/types v0.23.1/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=

Fixed code:
		// add secret to the appropriate map
		if s.GetAllowSubstitution() {
			c.Secrets[secret.Name] = s
		} else {
			c.NoSubSecrets[secret.Name] = s
		}
	lazyNoSubSecrets := make(map[string]*library.Secret)
			// add secret to the appropriate temp map
			if s.GetAllowSubstitution() {
				lazySecrets[secret.Name] = s
			} else {
				lazyNoSubSecrets[secret.Name] = s
			}
		c.Logger.Debug("injecting no-sub lazy loaded secrets")
		// inject secrets for container
		err = injectSecrets(tmpStep, lazyNoSubSecrets)
		if err != nil {
			return err
		}

		Logger       *logrus.Entry
		Vela         *vela.Client
		Runtime      runtime.Engine
		Secrets      map[string]*library.Secret
		NoSubSecrets map[string]*library.Secret
		Hostname     string
		Version      string
		reflect.DeepEqual(a.NoSubSecrets, b.NoSubSecrets) &&
	// instantiate map for non-substituted secrets
	c.NoSubSecrets = make(map[string]*library.Secret)

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, s.client.NoSubSecrets)
	if err != nil {
		return err
	}

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, c.NoSubSecrets)
	if err != nil {
		return err
	}

	logger.Debug("injecting non-substituted secrets")
	// inject no-substitution secrets for container
	err = injectSecrets(ctn, c.NoSubSecrets)
	if err != nil {
		return err
	}

	github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf
	github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d
	github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf h1:8Oka4tMHOdy/DsInyg7c/XPY5wqWWE7Yvzx/u67WBuw=
github.com/go-vela/sdk-go v0.23.2-0.20240312184917-e3a34719badf/go.mod h1:XjrVfIDw2SZDFBtJ5vqVse/GFj89MF542N20P8U5a3I=
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d h1:VynpkAIMt3KTh9BaICQdpu6c76/hHU3d4/Ab44bmFew=
github.com/go-vela/server v0.23.2-0.20240312184244-a645c822da1d/go.mod h1:EsDVTqQHQ9snXG2DhUl9uo4+Cf/b9nMiESCkxSjmP90=
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe h1:Fb28yre0nrX1GNeyPN8i8rruTlW8MnPVF3Fo5xTuOkg=
github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=