Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-52284

CVE-2024-52284: Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

7.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-52284
GHSA ID
GHSA-6h9x-9j5v-7w9h
EPSS Score
-
CWE
CWE-312
Published
8/29/2025
Updated
8/29/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/rancher/fleetgo>= 0.13.0, < 0.13.1-0.20250806151509-088bcbea7edb0.13.1-0.20250806151509-088bcbea7edb
github.com/rancher/fleetgo>= 0.12.0, < 0.12.60.12.6
github.com/rancher/fleetgo>= 0.11.0, < 0.11.100.11.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability, GHSA-6h9x-9j5v-7w9h, describes a scenario where sensitive Helm values are stored in plaintext within Fleet's BundleDeployment custom resources. This is because the mechanism for excluding these values files when creating a bundle was flawed.

The analysis of the provided patch, commit 088bcbea7edb844d7e6fc3649d9954f763cf68a9, points directly to the internal/bundlereader/resources.go file. The core of the issue lies in the ignoreApplyConfigs function. Before the patch, this function would only add the literal file paths from the valuesFiles directive to the ignore list. However, depending on how the fleet.yaml was structured, the file system could be traversed in a way that the path being checked for exclusion did not exactly match what was in the ignore list (e.g., checking values.yaml against an ignore list containing chart/values.yaml).

The patch rectifies this by adding both the original path and the base name of the file (e.g., values.yaml) to the ignore list, ensuring the file is excluded regardless of how it's referenced during processing. The ignoreApplyConfigs function is therefore the direct source of the vulnerability.

The Loadpaths function is the immediate caller of ignoreApplyConfigs and is responsible for using the generated ignore list to filter resources. As the primary exported function in this workflow, it serves as a key runtime indicator for the vulnerable operation. When fleet apply is executed, this function is called to construct the bundle, and its incorrect filtering leads to the inclusion of sensitive data. Therefore, both functions are identified as critical to the vulnerability.

Vulnerable functions

github.com/rancher/fleet/internal/bundlereader.ignoreApplyConfigs
internal/bundlereader/resources.go
This function is responsible for generating a list of file paths to be excluded from a Fleet bundle. Before the patch, it only added the exact path of `valuesFiles` as specified in `fleet.yaml`. This was insufficient because if a values file was referenced with a directory prefix (e.g., `my-chart/values.yaml`), but processed by its base name (`values.yaml`), it would not be excluded. The patch fixes this by also adding the base name of each values file to the exclusion list, ensuring that sensitive information in those files is not included in the `BundleDeployment` resource in plain text.
github.com/rancher/fleet/internal/bundlereader.Loadpaths
internal/bundlereader/resources.go
This function is responsible for loading all the resources that will be included in a bundle. It calls the `ignoreApplyConfigs` function to get a list of files to exclude. Due to the flaw in `ignoreApplyConfigs`, `Loadpaths` would fail to exclude certain Helm values files, leading to them being packaged into the bundle. As this is the exported function that orchestrates the vulnerable process, it would likely appear in a runtime profile during exploitation.

WAF Protection Rules

WAF Rule

### Imp**t * vuln*r**ility **s ***n i**nti*i** w**n usin* *l**t to m*n*** **lm ***rts w**r* s*nsitiv* in*orm*tion is p*ss** t*rou** `*un*l***ploym*nt.Sp**.Options.**lm.V*lu*s` m*y ** stor** in pl*in t*xt. T*is **n r*sult in: *. Un*ut*oriz** *is*losu

Reasoning

T** vuln*r**ility, **S*-***x-*j*v-*w**, **s*ri**s * s**n*rio w**r* s*nsitiv* **lm v*lu*s *r* stor** in pl*int*xt wit*in *l**t's `*un*l***ploym*nt` *ustom r*sour**s. T*is is ****us* t** m****nism *or *x*lu*in* t**s* v*lu*s *il*s w**n *r**tin* * *un*l*