CVE-2024-31216 json
source-controller leaks theAzure Storage SAS token into logs on connection errors
published 2024-05-15 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1788 , GHSA-v554-xwgw-hc3w , GO-2024-2859
- cvss
- 5.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.
Patch / fix
- go github.com/fluxcd/source-controller 1.2.5
- fluxcd source-controller 1.2.5
- github.com/fluxcd/source-controller@915d1a0 commit
- github.com/fluxcd/source-controller#1430 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/fluxcd/source-controller | <1.2.5 |
1.2.5 |
Affected products
- fluxcd source-controller
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/fluxcd/source-controller/pull/1430
web, patch
-
github.com
/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9
web, patch
-
github.com
/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-31216
advisory
-
github.com
/fluxcd/source-controller
package
Sources
- CVE List CVE-2024-31216
- GitHub Advisory GHSA-v554-xwgw-hc3w
- NVD CVE-2024-31216
- OSV GO-2024-2859
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.