CubeFS leaks users key in logs

Root

Cause CubeFS, an open-source cloud-native distributed file and object storage system, prior to version 3.3.1 leaks users' secret keys and access keys in the logs across multiple components. The flaw specifically occurs when CubeFS creates new users: the createKey function in the master component logs the access key and secret key via log.LogInfof("action[createUser], userID: %v, accesskey[%v], secretkey[%v]", userID, accessKey, secretKey), as shown in the fix commit [3].

Exploitation

An attacker with lower-privileged access to the system logs—either through direct log file access or via log aggregation services—can retrieve the leaked secret keys and access keys. No additional authentication or network position is required beyond the ability to read logs where these credentials are written [1][4].

Impact

By obtaining a user's secret key, the attacker can impersonate that user, including those with higher privileges. This enables the attacker to perform actions on behalf of the victim, potentially compromising the confidentiality, integrity, and availability of the CubeFS cluster [1][4].

Mitigation

The vulnerability has been patched in CubeFS version 3.3.1. There is no workaround available; upgrading to the patched version is the only mitigation [1][4]. The issue was discovered during a security audit by Ada Logics in collaboration with OSTIF and the CNCF [4].