oras-go Credential Leak via Malicious Registry Location Header

Executive Summary

This vulnerability in oras-go before version 2.6.1 involves a flaw in the blobStore.completePushAfterInitialPost function. During monolithic blob upload, the code follows a registry-controlled Location header and reuses the Authorization header from the initial POST request for a subsequent PUT request. A malicious registry can exploit this by returning a cross-host Location, causing the client to send its credentials to an attacker-controlled endpoint.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper handling of the Location header during blob uploads in oras-go versions prior to 2.6.1. Detection requires checking the version of oras-go in use. Use commands like 'go list -m github.com/oras-project/oras-go/v2' to verify the installed version. If the version is below 2.6.1, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept your credentials if you use a compromised or malicious registry. This could lead to unauthorized access to your account or resources, potentially resulting in data breaches or further attacks on systems you interact with.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade oras-go to version 2.6.1 or later immediately. Use 'go get -u github.com/oras-project/oras-go/[email protected]' to update. Review registry configurations to ensure trusted sources are used. Monitor for unauthorized credential exposure if the vulnerability was exploited before patching.

Useful 0 Not Useful 0