CVE-2021-21432
📋 TL;DR
CVE-2021-21432 is an authentication bypass vulnerability in Vela CI/CD framework that allows malicious users to access secrets stored in the ~/.netrc file. This affects Vela server versions 0.7.0 through 0.7.4. Organizations using vulnerable Vela deployments for pipeline automation are at risk of credential theft.
💻 Affected Systems
- Vela CI/CD Server
📦 What is this software?
Vela by Go Vela
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of CI/CD pipeline secrets including source code credentials, deployment keys, and sensitive environment variables leading to supply chain attacks.
Likely Case
Unauthorized access to repository credentials and deployment secrets enabling code exfiltration or unauthorized deployments.
If Mitigated
Limited impact with proper network segmentation and minimal secrets stored in vulnerable configurations.
🎯 Exploit Status
Exploitation requires some level of access to the system but authentication bypass enables credential extraction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.5
Vendor Advisory: https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Stop Vela server. 3. Update to version 0.7.5 using package manager or manual installation. 4. Restart Vela server. 5. Verify functionality.
🔧 Temporary Workarounds
Remove ~/.netrc credentials
linuxDelete or secure credentials stored in the ~/.netrc file used by Vela
rm ~/.netrc
chmod 600 ~/.netrc if credentials must remain
Network isolation
linuxRestrict network access to Vela server to trusted sources only
iptables -A INPUT -p tcp --dport [VELA_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [VELA_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Vela server
- Rotate all credentials that might be stored in ~/.netrc files and monitor for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check Vela server version: vela version. If version is between 0.7.0 and 0.7.4 inclusive, system is vulnerable.Check Version:
vela versionVerify Fix Applied:
After patching, verify version is 0.7.5 or higher: vela version. Test authentication mechanisms work properly.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed authentication attempts followed by successful access
- Access to ~/.netrc file by Vela processes
Network Indicators:
- Unusual API calls to secrets endpoints
- Traffic from unexpected sources to Vela server
SIEM Query:
source="vela" AND (event="authentication_failure" OR event="secret_access") | stats count by src_ip🔗 References
- https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46
- https://github.com/go-vela/server/pull/337
- https://github.com/go-vela/server/releases/tag/v0.7.5
- https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4
- https://pkg.go.dev/github.com/go-vela/server
- https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46
- https://github.com/go-vela/server/pull/337
- https://github.com/go-vela/server/releases/tag/v0.7.5
- https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4
- https://pkg.go.dev/github.com/go-vela/server
