Listen to this Post
How the mentioned CVE works:
The vulnerability CVE-2024-31453 is a credential disclosure flaw in the Grype vulnerability scanner. In affected versions, when registry authentication credentials are configured via a config file or environment variables, the Grype command-line interface fails to sanitize these sensitive values before writing them to a file. This occurs specifically when using the `–file` or `–output json=
Platform: Grype
Version: v0.68.0-v0.104.0
Vulnerability : Credential Disclosure
Severity: Critical
date: 2024
Prediction: 2024-04-24
What Undercode Say:
Vulnerable command grype --output json=report.json alpine:latest Check output for leaked creds cat report.json | jq '.descriptor.registry.auth' Safe workaround command grype --output json alpine:latest > report.json
How Exploit:
An attacker with read access to the output directory can harvest registry credentials. The exploit is passive; it involves locating and exfiltrating the JSON files generated by a Grype scan. No active interaction with the Grype process is required. The credentials can then be used to gain unauthorized access to the protected container registry, potentially allowing image pulls or pushes.
Protection from this CVE
Upgrade to Grype v0.104.1.
Use stdout redirection.
Avoid using `–file` flag.
Audit existing output files.
Rotate exposed credentials.
Impact:
Unauthorized registry access.
Supply chain compromise.
Credential theft.
Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
