Change:
This issue was reported in the Description Kubernetes requires an authentication mechanism to enforce users’ privileges. One method of authentication, bearer tokens, are opaque strings used to associate a user with their having successfully authenticated previously. Any user with possession of this token may masquerade as the original user (the “bearer”) without further authentication. Within Kubernetes, the bearer token is captured within the hyperkube kube-apiserver system logs at high verbosity levels (--v 10). A malicious user with access to the system logs on such a system could masquerade as any user who has previously logged into the system. Exploit Scenario Alice logs into a Kubernetes cluster and is issued a Bearer token. The system logs her token. Eve, who has access to the logs but not the production Kubernetes cluster, replays Alice’s Bearer token, and can masquerade as Alice to the cluster. Recommendation Short term, remove the Bearer token from the log. Do not log any authentication credentials within the system, including tokens, private keys, or passwords that may be used to authenticate to the production Kubernetes cluster, regardless of the logging level. Long term, either implement policies that enforce code review to ensure that sensitive data is not exposed in logs, or implement logging filters that check for sensitive data and remove it prior to outputting the log. In either case, ensure that sensitive data cannot be trivially stored in logs. Anything else we need to know?: See for current status of all issues created from these findings. The vendor gave this issue an ID of TOB-K8S-001 and it was finding 6 of the report. The vendor considers this issue Medium Severity. To view the original finding, begin on page 31 of the Environment: Kubernetes version: 1.13.4
/sig auth /sig api-machinery
/remove-kind feature /kind bug
Should remote the "Authorization" header here?
for authorization headers, everything after the type should be masked (and potentially, only recognized auth types should be logged). Something like:
I think people would be unpleasantly surprised to see credentials in a logfile after turning up logging to debug an issue. /priority important-soon
Does either of you intend to createe PR to remove the "Authorization" header ?
This issue seems CVE-worthy to me: loss of confidentiality (bearer tokens) + cross of privilege boundary (debug log level could be set by admin, then logs read later by low privileged user). My draft cvss would be: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (5.3)
Two potential vectors: local user with access to system logs (local access, low privilege) (4.7) remote user with access to system logs (network access, high privilege): (4.4) CVE-2019- has been assigned to this issue.
If you want to, go ahead
- should this have the official CVE feed label ( retrospectively, I mean)?
probably? I have no idea how that label is supposed to get applied, but there appear to be several CVE issues that don't have it -
I think you're likely to know who to highlight this to. Sorry to mention you individually; please feel free to point out docs if there are any.
/label official-cve-feed thanks for the tag, the label now!
thanks for the useful filter. Currently in-scope issues are issues that were closed as fixed by code changes to k/k. So with that in mind, I have the labels to some of the closed issues too that conform to the scope defined here:
I would like to reply nearly four years later: There are valid cases to want to see the token, for example my current case, trying to debug token validation between the API server and other services.

Discussion:
} } <ins> var knownAuthTypes = map[string]bool{ "bearer":    true, "basic":     true, "negotiate": true, } // maskValue masks credential content from authorization headers // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization func maskValue(key string, value string) string { if !strings.EqualFold(key, "Authorization") { return value } if len(value) == 0 { return "" } var authType string if i := strings.Index(value, " "); i > 0 { authType = value[0:i] } else { authType = value } if !knownAuthTypes[strings.ToLower(authType)] { return "<masked>" } if len(value) > len(authType)+1 { value = authType + " <masked>" } else { value = authType } return value } </ins> func (rt *debuggingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) { reqInfo := newRequestInfo(req)

klog.Infof("Request Headers:") for key, values := range reqInfo.RequestHeaders { for _, value := range values { <ins> value = maskValue(key, value) </ins> klog.Infof("    %s: %s", key, value) } }

return rt.Response, rt.Err } <ins> func TestMaskValue(t *testing.T) { tcs := []struct { key      string value    string expected string }{ { key:      "Authorization", value:    "Basic YWxhZGRpbjpvcGVuc2VzYW1l", expected: "Basic <masked>", }, { key:      "Authorization", value:    "basic", expected: "basic", }, { key:      "Authorization", value:    "Basic", expected: "Basic", }, { key:      "Authorization", value:    "Bearer cn389ncoiwuencr", expected: "Bearer <masked>", }, { key:      "Authorization", value:    "Bearer", expected: "Bearer", }, { key:      "Authorization", value:    "bearer", expected: "bearer", }, { key:      "Authorization", value:    "bearer ", expected: "bearer", }, { key:      "Authorization", value:    "Negotiate cn389ncoiwuencr", expected: "Negotiate <masked>", }, { key:      "ABC", value:    "Negotiate cn389ncoiwuencr", expected: "Negotiate cn389ncoiwuencr", }, { key:      "Authorization", value:    "Negotiate", expected: "Negotiate", }, { key:      "Authorization", value:    "Negotiate ", expected: "Negotiate", }, { key:      "Authorization", value:    "negotiate", expected: "negotiate", }, { key:      "Authorization", value:    "abc cn389ncoiwuencr", expected: "<masked>", }, { key:      "Authorization", value:    "", expected: "", }, } for _, tc := range tcs { maskedValue := maskValue(tc.key, tc.value) if tc.expected != maskedValue { t.Errorf("unexpected value %s, given %s.", maskedValue, tc.value) } } } </ins> func TestBearerAuthRoundTripper(t *testing.T) { rt := &testRoundTripper{} req := &http.Request{}

framework.ExpectError(err) gomega.Expect(err).To(gomega.ContainSubstring("Using in-cluster namespace")) gomega.Expect(err).To(gomega.ContainSubstring("Using in-cluster configuration")) <del> gomega.Expect(err).To(gomega.ContainSubstring("Authorization: Bearer invalid")) </del> gomega.Expect(err).To(gomega.ContainSubstring("Response Status: 401 Unauthorized")) ginkgo.By("trying to use kubectl with invalid server")