CVE-2022-23538 : Security Advisory and Response

A vulnerability has been identified in the scs-library-client component that allows user credentials to be leaked to a third-party service via HTTP redirect. This poses a risk of unauthorized access and impersonation by malicious actors.

Understanding CVE-2022-23538

This section explains the nature of the vulnerability, its impact, technical details, and mitigation strategies.

What is CVE-2022-23538?

The vulnerability in scs-library-client allows the HTTP Authorization header, containing user credentials, to be inadvertently leaked to a third-party S3 storage provider during a specific flow involving a multi-part concurrent download from a redirected server.

The Impact of CVE-2022-23538

If exploited, an attacker with access to the S3 storage service could extract user credentials and potentially impersonate the user. This flow is only triggered when interacting with a Singularity Enterprise 1.x installation or a third-party server implementing this specific flow.

Technical Details of CVE-2022-23538

This section delves into the specifics of the vulnerability, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

When using scs-library-client for container image retrieval, the incorrect leakage of user credentials in the HTTP Authorization header can occur during interactions with a redirected S3 backing storage service.

Affected Systems and Versions

Versions of scs-library-client prior to 1.34 and between 1.4.0 to 1.4.2 are impacted by this vulnerability, affecting users interacting with Singularity Enterprise 1.x installations using a 3rd party S3 storage service.

Exploitation Mechanism

The vulnerability arises due to a specific flow whereby the scs-library-client interacts with a redirected S3 server, allowing for the extraction of user credentials by a malicious actor with access to the S3 service.

Mitigation and Prevention

This section provides guidance on immediate steps to take, long-term security practices, and the importance of patching and updates.

Immediate Steps to Take

Users are strongly advised to update their scs-library-client to the latest version to mitigate the risk of user credential leakage. Additionally, users interacting with Singularity Enterprise 1.x installations utilizing a 3rd party S3 storage service should revoke and recreate their authentication tokens.

Long-Term Security Practices

To enhance security posture, users are encouraged to implement secure authentication practices, regularly review and update their software components, and stay informed about security best practices.

Patching and Updates

It is critical for users to apply the latest patches and updates provided by the vendor to address the vulnerability effectively and prevent potential exploitation.