CVE-2023-3361

OpenShift Data Science exports S3 credentials as plain text

• CVSS 7.5
• CWE-319 Cleartext Transmission of Sensitive Information
• Information Leakage
• Local

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.

CVE

CVE-2023-3361

CWE

CWE-319 Cleartext Transmission of Sensitive Information

CVSS base score

7.5

Published

2023-10-04

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Elyra to version 3.1.0 or higher.

import os
import yaml

def export_pipeline(pipeline, output_format='yaml'):
    s3_access_key = os.getenv('S3_ACCESS_KEY')
    s3_secret_key = os.getenv('S3_SECRET_KEY')

    export_data = {
        'pipeline': pipeline,
        's3_credentials': {
            'access_key': s3_access_key,
            'secret_key': s3_secret_key
        }
    }

    if output_format == 'yaml':
        with open('pipeline_export.yaml', 'w') as file:
            yaml.dump(export_data, file)
    elif output_format == 'python_dsl':
        with open('pipeline_export.py', 'w') as file:
            file.write(f"pipeline = {pipeline}\n")
            file.write(f"s3_credentials = {{'access_key': '{s3_access_key}', 'secret_key': '{s3_secret_key}'}}\n")

import os
import yaml

def export_pipeline(pipeline, output_format='yaml'):
    s3_access_key = os.getenv('S3_ACCESS_KEY')
    s3_secret_key = os.getenv('S3_SECRET_KEY')

    export_data = {
        'pipeline': pipeline,
        's3_credentials': {
            'access_key': s3_access_key,
            'secret_key': s3_secret_key
        }
    }

    if output_format == 'yaml':
        with open('pipeline_export.yaml', 'w') as file:
            yaml.safe_dump(export_data, file)
    elif output_format == 'python_dsl':
        with open('pipeline_export.py', 'w') as file:
            file.write(f"pipeline = {pipeline}\n")
            file.write(f"s3_credentials = {{'access_key': '{s3_access_key}', 'secret_key': '{s3_secret_key}'}}\n")

@misc{vaitp:cve20233361,
  title        = {{OpenShift Data Science exports S3 credentials as plain text}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-3361},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-3361/}}
}