-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/anchore/grype | go | >= 0.68.0, < 0.104.1 | 0.104.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of sensitive registry credentials during the generation of JSON reports. The analysis of the patch commit c99f79de49a58dc16d7fd8f35160b169b87db9de reveals two key functions involved in the vulnerability.
First, the options.secret.String() method in cmd/grype/cli/options/secret.go was the root cause of the credential disclosure. This method, intended to provide a string representation of a secret type, was implemented to return the raw, unredacted secret. Go's standard JSON library, when encoding a struct, will use the String() method for fields that implement the fmt.Stringer interface if a MarshalText method is not present. This resulted in sensitive credentials being serialized directly into the JSON output.
Second, the commands.runGrype function in cmd/grype/cli/commands/root.go was the high-level orchestrator of this vulnerable process. It gathered all the configuration, including the registry credentials, and passed it down for report generation via models.NewDocument. The patch adds a line to explicitly nullify the credentials (opts.Registry.Auth = nil) before this step, confirming that this function was part of the chain that passed sensitive data to the serialization process.
Therefore, an attacker could trigger this vulnerability by configuring registry credentials and running a Grype scan with the output directed to a JSON file using --file or --output json=<file>. During exploitation, a runtime profile would show commands.runGrype initiating the process and options.secret.String being called during the JSON serialization phase, leaking the credentials.
commands.runGrypecmd/grype/cli/commands/root.go
options.secret.Stringcmd/grype/cli/options/secret.go
GoGoOngoing coverage of React2Shell