7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h5f8-crrq-4pw8

GHSA-h5f8-crrq-4pw8: Contrast workload secrets leak to logs on INFO level

Impact

When the Contrast initializer is configured with a CONTRAST_LOG_LEVEL of info or debug, the workload secret is logged to stderr and written to Kubernetes logs.

Since info is the default setting, this affects all Contrast installations that don't customize their initializers' log level.

The following audiences are intended to have access to workload secrets (see https://docs.edgeless.systems/contrast/1.7/architecture/secrets#workload-secrets):

Contrast Coordinator (can derive all workload secrets)
Contrast Initializer (obtains only the secret configured in the manifest)
Seedshare owner (can derive all workload secrets)
Workload owner (can update manifests to obtain secrets)

This vulnerability allows the following parties unintended access to workload secrets issued by a Coordinator:

Kubernetes users with get or list permission on pods/logs.
Others with read access to the Kubernetes log storage (most notably, the cloud provider).

This vulnerability does not affect scenarios where workload secrets are not used by the application (directly or with secure persistence). Applications designed for workload owner exclusion can't use workload secrets and are thus unaffected.

Patches

N/A

Workarounds

This vulnerability can be mitigated by adding an environment variable CONTRAST_LOG_LEVEL=warn to the initializer after running contrast generate, and then running contrast generate again.

References

N/A

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h5f8-crrq-4pw8

GHSA-h5f8-crrq-4pw8:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/edgelesssys/contrast	go	<= 1.8.0	1.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (GHSA-h5f8-crrq-4pw8) describes a scenario where workload secrets are leaked to logs if the CONTRAST_LOG_LEVEL is set to info (the default) or debug. The affected package is github.com/edgelesssys/contrast, with versions <= 1.8.0 being vulnerable and 1.8.1 being the first patched version.

By comparing the commits between version 1.8.0 (commit 2c24641985716f83f6a228f57fbe92e8538fa2dd) and 1.8.1 (commit f3b9ef837d686781726b4567fec3fcb74779395e), a relevant commit 5041d52fbcdc19380d78fb7a471ef0a1addc55ab with the message "initializer: don't log full response" was identified.

This commit modifies the initializer/main.go file. Specifically, within the run function, the line log.Info("Requesting cert", "response", resp) was changed to log.Debug("Received response", "meshCA", resp.MeshCACert, "rootCA", resp.RootCACert, "certChain", resp.CertChain).

This change directly addresses the vulnerability:

It changes the log level for this specific message from Info to Debug. Since the vulnerability occurs when the log level is Info (default) or Debug, changing this specific sensitive log to Debug means it won't appear if the global log level is Info or higher (e.g., Warn, which is the recommended workaround).
It changes what is logged. Instead of logging the entire resp object, which presumably contained the workload secret, it now logs specific, less sensitive fields from the response.

Therefore, the run function in initializer/main.go is the vulnerable function because it was responsible for logging the sensitive information (the full response resp) at an inappropriate log level (Info). During exploitation (i.e., when the log level is Info or Debug), this function would be part of the execution path leading to the secret leakage, and its logging action would be the direct cause of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.