Missing filtering when the helmRepoURLRegex field isnt set on a GitRepo resource in SUSE Rancher Fleets bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rancher_fleet | Suse | 0.12.0 (including) | 0.12.15 (excluding) |
| Rancher_fleet | Suse | 0.13.0 (including) | 0.13.11 (excluding) |
| Rancher_fleet | Suse | 0.14.0 (including) | 0.14.6 (excluding) |
| Rancher_fleet | Suse | 0.15.0 (including) | 0.15.2 (excluding) |