CVE-2024-31216: 
vulnerability analysis and mitigation

The vulnerability (CVE-2024-31216) affects the source-controller, a Kubernetes operator specialized in artifacts acquisition from external sources. Prior to version 1.2.5, when configured to use an Azure SAS token for Azure Blob Storage connections, the controller would expose sensitive authentication tokens in logs during connection errors. The vulnerability was discovered and reported by Jagpreet Singh Tamber from the Azure Arc team (GitHub Advisory).

The vulnerability stems from improper handling of error logging where the Azure Storage SAS (Shared Access Signature) token was being logged along with the Azure URL when the controller encountered connection errors. The issue has been assigned a CVSS v3.1 base score of 5.1 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating local access is required but no privileges or user interaction is needed. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File) (GitHub Advisory).

An attacker with access to the source-controller logs could potentially extract the exposed SAS token and use it to gain unauthorized access to the Azure Blob Storage. This access would persist until the token's expiration, potentially allowing the attacker to read and modify stored data (GitHub Advisory).

The vulnerability requires local access to the source-controller logs. No special privileges or user interaction is needed to exploit the vulnerability if an attacker can access these logs (GitHub Advisory).

The vulnerability has been fixed in source-controller version 1.2.5. For users unable to upgrade immediately, the recommended workaround is to use a different authentication mechanism, such as Azure Workload Identity, instead of SAS tokens (GitHub Advisory).