Listen to this Post
The vulnerability operates through Spinnaker’s artifact providers that accept user-supplied URLs for data retrieval. When enabled, such as HTTP artifact providers without authentication, users can specify arbitrary URLs to fetch remote data. This data is then injectable into Spinnaker pipelines via Helm charts or Kubernetes manifests. By targeting internal URLs, attackers can access sensitive authentication data like IAMv1 credentials or invoke internal Spinnaker APIs. Artifacts configured with authentication headers may leak credentials to arbitrary endpoints. Exploitation requires Spinnaker installations with artifact types allowing user input, including GitHub, BitBucket, GitLab, or HTTP artifacts. The HTTP artifact provider, if enabled, defaults to a no-auth state, permitting fetches from any URL, including local network services like AWS instance metadata. This can lead to credentials exposure. Additionally, the vulnerability enables denial-of-service attacks by providing URLs that return infinite data streams, overwhelming Spinnaker services. Proper limits on HTTP requests and artifact URLs are recommended to mitigate such attacks. The vulnerability is fixed in specific clouddriver versions.
Platform: Spinnaker
Version: All prior releases
Vulnerability: Remote URL fetch
Severity: Critical
Date: 2025
Prediction: Patched versions available
What Undercode Say:
Analytics:
Check HTTP artifact provider in configuration
grep "artifact.http" spinnaker-config.yml
Test URL fetch via curl simulation
curl -X POST $SPINNAKER_API/pipelines -d '{"artifacts":[{"type":"http","reference":"http://internal/metadata"}]}'
List enabled artifact accounts
kubectl get configmap spinnaker-config -o yaml | grep artifact
How Exploit:
Create pipeline with HTTP artifact fetching internal URLs or infinite data streams to extract credentials or cause denial-of-service.
Protection from this CVE
Disable HTTP artifact accounts; use OPA policies; update to patched clouddriver versions.
Impact:
Credentials exposure; internal API access; denial-of-service attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
