Information Disclosure in Red Hat Konflux CI Workflow Scripts

Executive Summary

This vulnerability is an information disclosure flaw in konflux-ci. An attacker with permission to trigger automated workflow runs can exploit it by providing specially crafted issue titles to workflow scripts. The scripts then include these titles directly in data queries without proper sanitization, allowing the injection of malicious filter commands. This can expose sensitive data like API credentials, deployment keys, and internal notes in workflow logs.

Useful 0 Not Useful 0

Detection Guidance

Check workflow logs for suspicious filter commands or unexpected data exposures. Look for crafted issue titles in automated workflow runs that may contain malicious query syntax. Review CI/CD pipeline logs for API credentials, deployment keys, or internal notes that appear in logs without being explicitly output by the workflow.

Useful 0 Not Useful 0

Impact Analysis

If you use konflux-ci and an attacker gains permission to trigger workflow runs, they could access sensitive information such as API credentials, deployment keys, and internal notes. This exposure occurs through workflow logs, potentially leading to unauthorized access to systems or data if those credentials are reused elsewhere.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Exposure of credentials or internal notes may result in data breaches, triggering legal penalties, audit failures, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict permissions for triggering workflow runs to only trusted users. Implement input sanitization for issue titles in workflow scripts. Review and redact sensitive information from CI logs. Consider disabling affected workflow scripts until patches are available.

Useful 0 Not Useful 0