CVE-2024-41129

Ops library exposes secrets via CLI args, affecting Juju charm security.

• CVSS 4.4
• CWE-532
• Information Leakage
• Local

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0.

CVE

CVE-2024-41129

CWE

CWE-532

CVSS base score

4.4

Published

2024-07-22

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Local

Impact

Information Disclosure

Affected component

ops library

Fixed by upgrading

Yes

Solution

Upgrade to ops library version 2.15.0 or later.

import subprocess

def run_command_with_secret(secret):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to command injection
    try:
        result = subprocess.run(
            ['your_command', 'arg1', 'arg2', secret],
            check=True,
            capture_output=True,
            text=True
        )
        print(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"Command failed with error: {e.stderr}")

run_command_with_secret('my_secret_value')

import subprocess

def run_command_with_secret(secret):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    try:
        result = subprocess.run(
            ['your_command', 'arg1', 'arg2'],
            env={'SECRET_ENV': secret},
            check=True,
            capture_output=True,
            text=True
        )
        print(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"Command failed with error: {e.stderr}")

run_command_with_secret('my_secret_value')

'$(cat /etc/passwd)'

@misc{vaitp:cve202441129,
  title        = {{Ops library exposes secrets via CLI args, affecting Juju charm security.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-41129},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-41129/}}
}