GHSA-4cj6-vfwp-8pq7: 
Python vulnerability analysis and mitigation

Problem

resolve_secret_debug (server/secrets_routes.py:300-301) resolves an arbitrary caller-supplied ref with no allowlist and no scope binding. parse_ref (secrets/secret_resolver.py:27) maps any UPPERCASE name (or env://NAME) to an env lookup, so a caller can resolve CUGA_SECRET_KEY (the Fernet master key), VAULT_TOKEN, cloud creds — anything in the process environment. The "mask" is not opaque: val[:4] + "••••" + val[-2] returns the verbatim first four characters plus one, plus a resolved: true/false existence oracle. There is no rate limiting. Combined with the unauthenticated-by-default secrets API (see the companion advisory), this is reachable with no authentication at all.

Impact

For high-entropy keys the 4-character prefix is a known scheme string (limited value), but for short/structured secrets (PINs, short passwords, tokens) it is most of the secret — plus a reliable "does this env var exist" oracle across the whole process environment.

Reproduction

os.environ["CUGA_SECRET_KEY"] = "gAAAA_fake_fernet_master_key_zz"   # the DB master key
from cuga.backend.server import secrets_routes
app = FastAPI(); app.include_router(secrets_routes.router)
client = TestClient(app)

# No Authorization header is sent (auth.enabled=false is the shipped default).
print(client.post("/api/secrets/resolve", json={"ref": "CUGA_SECRET_KEY"}).json())

# -> {'resolved': True, 'masked': 'gAAA••••z'}   # first 4 chars of the master key, unauthenticated

Reproduced against unmodified code.

Locations

• server/secrets_routes.py:300-301
• secrets/secret_resolver.py:27

Proposed fix

• Restrict resolvable refs to an allowlist of registered slugs owned by the caller; reject bare-env / env:// / vault:// / aws:// refs.
• Gate the endpoint behind require_manage_access; add rate limiting.
• Return {"resolved": bool} only — no verbatim characters of the value.

Acceptance criteria

Resolving CUGA_SECRET_KEY / OPENAI_API_KEY by raw name returns 403/404 and never returns characters of the value.

Severity scoring

CVSS 3.1: 7.5 high — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N PR:N: reachable with no authentication on the shipped defaults, via the companion advisory on the secrets API. C:H is a deliberate reading, and the one metric worth stating plainly: this project scores any partial disclosure of a credential as compromise of that credential. The endpoint returns four verbatim characters plus a reliable existence oracle across the entire process environment, including CUGA_SECRET_KEY, with no rate limiting. The alternative reading is C:L, giving 5.3, on the basis that four characters of a high-entropy key is a scheme prefix of limited value and that secrets of six characters or fewer return no characters at all. Operators who take that view should re-score accordingly. This scores identically to the path-traversal advisory even though that one reads whole files. CVSS 3.1 caps pure confidentiality loss at 7.5 regardless of how much is disclosed, so the two land on the same number.

Fixed in 0.4.4

Fixed by e935697d, released in v0.4.4 (PyPI cuga==0.4.4).

• POST /api/secrets/resolve is removed. Nothing in the codebase called it. A request to it now gets 405 and no characters of any value; no other route resolves a reference that the caller supplies.
• The rest of the secrets API is gated as described in the companion advisory, GHSA-r2pq-mqwg-m575: with auth off, only same-machine callers; with auth on, a manage role. Workaround for 0.4.3 and earlier. Upgrade. If you cannot: keep the default --host 127.0.0.1, do not expose the port, and do not browse untrusted sites while CUGA runs with auth off.