Insights-Client Logs Cloud Pull-Secret Token Exposure

Executive Summary

This vulnerability affects the insights-client package in Red Hat Enterprise Linux 9. When the client makes a request to the cloud.openshift.com API and receives a non-200 HTTP response, it logs the request headers at high verbosity levels. This includes the Authorization header containing the cluster's long-lived pull-secret bearer token, a sensitive credential for Red Hat cloud services. Local users with access to pod logs could read this token and potentially gain unauthorized access to Red Hat cloud services.

Useful 0 Not Useful 0

Detection Guidance

Check pod logs on the hub for insights-client entries at verbosity level 3 or higher. Look for Authorization headers containing pull-secret tokens in stderr or log files. Use commands like 'oc logs <pod-name>' or 'journalctl -u insights-client' to inspect logs for sensitive data exposure.

Useful 0 Not Useful 0

Impact Analysis

If you have access to pod logs on the hub, an attacker could exploit this to read the pull-secret token. This token grants unauthorized access to Red Hat cloud services, potentially leading to data breaches or service misuse. The impact is limited to users with existing log access permissions and requires specific logging conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of the pull-secret token may result in non-compliance with data protection regulations due to potential data breaches or unauthorized access to cloud services.

Useful 0 Not Useful 0

Mitigation Strategies

Reduce insights-client logging verbosity to level 2 or below to prevent header logging. Restrict pod log access permissions to only necessary users. Monitor logs for unauthorized token exposure and rotate pull-secret tokens if compromised.

Useful 0 Not Useful 0