Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
runatlantis atlantis
< 0.30.0affected
References
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rp ↗
- https://github.com/runatlantis/atlantis/issues/4060 ↗
- https://github.com/runatlantis/atlantis/pull/4667 ↗
- https://argo-cd.readthedocs.io/en/stable/operator-manual/security ↗
- https://github.com/runatlantis/atlantis/releases/tag/v0.30.0 ↗