CVE-2024-28236: 
NixOS vulnerability analysis and mitigation

Vela, a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang, has been found to contain a security vulnerability (CVE-2024-28236) that affects versions up to 0.23.1. The vulnerability allows pipeline authors to bypass log masking and expose secrets through variable substitution combined with insensitive fields like parameters, image, and entrypoint, without using the commands block (Vendor Advisory).

The vulnerability primarily impacts secrets restricted by the "no commands" option. Through variable substitution and string manipulation, attackers can inject secrets into a plugin/image using various methods including parameters (example: ${EXAMPLE_SECRET}), image tags (:latest${EXAMPLE_SECRET}), or entrypoint as a command shim. The vulnerability has received a CVSS v3.1 base score of 7.7 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, and high impact on confidentiality (NVD).

The vulnerability can lead to unintended exposure of secret values during image execution, bypassing log masking protections. This is particularly concerning for secrets that are restricted by the "no commands" option and use image restriction, as the substitution tinkering turns these security controls into a false sense of security. The impact is heightened when secrets are exposed through plugins that print parameters in logs (Vendor Advisory).

To exploit this vulnerability, a pipeline author must supply secrets to a plugin that is designed to print parameters in logs. The exploitation risk is increased for secrets with pull_request events enabled, as this allows users to modify pipeline configurations and pull secrets into steps not typically part of the CI process. Plugin parameters are not designed for sensitive values and are often intentionally printed during execution for informational/debugging purposes (Vendor Advisory).

The issue has been addressed in version 0.23.2. For users unable to upgrade, several workarounds are recommended: avoid providing sensitive values to plugins that might expose them, ensure plugins follow best practices for handling sensitive parameters, minimize secrets with pull_request events enabled, implement build approval settings to restrict builds from untrusted users, and limit the use of shared secrets. Additionally, users should understand how values injected into plugins are used, as this is a common risk in many CI/CD systems (Vendor Advisory).