Listen to this Post
The vulnerability exists in the Hermes command-line interface where subcommands accepting arbitrary options via the `-O` argument log these options in plain text. The logging function at the affected code line records the full command-line string, including any sensitive values passed to the `-O` flags, such as authentication tokens. For example, executing `hermes deposit -O invenio_rdm.auth_token SECRET_KEY` writes the literal token “SECRET_KEY” to the `hermes.log` file. This creates a persistent cleartext record of credentials on disk or in CI system logs, accessible to anyone with read permissions to those log files or artifacts.
dailycve form:
Platform: Hermes CLI
Version: < 0.9.1
Vulnerability: Plaintext secret logging
Severity: Critical
date: 2024-05-15
Prediction: Patch released 2024-05-16
What Undercode Say:
Analytics:
Check if vulnerable version is installed pip show hermes | grep Version Example vulnerable command that leaks to log hermes deposit -O invenio_rdm.auth_token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Grep for exposed secrets in log files grep -r "auth_token" hermes.log
How Exploit:
Attacker reads `hermes.log` file on shared system or accesses public CI/CD log artifacts to harvest exposed API tokens and secrets.
Protection from this CVE:
Upgrade to hermes>=0.9.1. Manually audit and rotate exposed tokens. Secure log file permissions.
Impact:
Unauthenticated secret disclosure. CI token compromise. Unauthorized system access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
