Git credentials are exposed in atlantis logs

Vulnerability

Overview

CVE-2024-52009 describes a logging flaw in Atlantis, a self-hosted Terraform webhook listener. When GitHub credentials (tokens starting with ghs_) are rotated, Atlantis writes the token value into debug-level logs [2]. This occurs in the credential rotation logic, specifically in vcs/gh_app_creds_rotator.go and vcs/git_cred_writer.go, as confirmed by the advisory [4].

Exploitation

Scenario

An attacker does not need authentication to Atlantis itself; they only require read access to the log stream where these credentials appear. For example, in deployments where Atlantis runs as an Argo CD application, users with read-only Argo CD access can view the logs [1]. No special privileges within GitHub or Atlantis are needed beyond log visibility.

Impact

With the leaked token, an attacker can impersonate the Atlantis GitHub App, performing any action the app is authorized to do. If Atlantis manages a GitHub organization (e.g., via Terraform), the attacker can gain organization admin privileges, compromising all repositories. This can escalate to cluster admin if those repositories contain Infrastructure-as-Code for Kubernetes clusters [1][4].

Mitigation

The issue was fixed in Atlantis v0.30.0, as noted in the release changelog [3]. The fix prevents logging of GitHub tokens during rotation. There are no known workarounds; all users are advised to upgrade immediately [2][4].