CVE-2024-3744

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3744
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/05/09/4
https://github.com/kubernetes/kubernetes/issues/124759
https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ
http://www.openwall.com/lists/oss-security/2024/05/09/4
https://github.com/kubernetes/kubernetes/issues/124759
https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ
Configurations

No configuration.

History

21 Nov 2024, 09:30

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/05/09/4 - () http://www.openwall.com/lists/oss-security/2024/05/09/4 -
References () https://github.com/kubernetes/kubernetes/issues/124759 - () https://github.com/kubernetes/kubernetes/issues/124759 -
References () https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ - () https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ -

10 Jun 2024, 16:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/05/09/4 -
Summary
  • (es) Se descubrió un problema de seguridad en azure-file-csi-driver donde un actor con acceso a los registros del controlador podía observar los tokens de la cuenta de servicio. Estos tokens podrían luego intercambiarse con proveedores de nube externos para acceder a los secretos almacenados en soluciones de bóveda en la nube. Los tokens solo se registran cuando TokenRequests está configurado en el objeto CSIDriver y el controlador está configurado para ejecutarse en el nivel de registro 2 o superior mediante el indicador -v.

15 May 2024, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-15 01:15

Updated : 2024-11-21 09:30

NVD link : CVE-2024-3744

Mitre link : CVE-2024-3744

CVE.ORG link : CVE-2024-3744

JSON object : View

Products Affected

No product.

CWE
CWE-532

Insertion of Sensitive Information into Log File