GHSA-88p2-jj8w-j8qg: Infoleak
Summary
The target search endpoint (POST /api/latest/fleet/targets) returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply the same sanitization.
Impact
An authenticated user with Observer, Observer+, or Technician role (global or team-scoped) could retrieve unmasked team enroll secrets and team agent options by performing a target search against an observer-runnable query.
With a leaked team enroll secret, an attacker could enroll unauthorized hosts into the affected team. If the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were also exposed.
Patches
- v4.87.0
Workarounds
If an immediate upgrade is not possible, administrators should:
- Rotate team enroll secrets for any team that may have been exposed - Rotate any credentials stored in team agent options (AWS keys, proxy passwords, session tokens) - Restrict Observer and Technician roles to fully trusted users until the patch is applied
Credits
Fleet thanks @fuzzztf for responsibly reporting this issue.
For more information
If there are any questions or comments about this advisory:
Send an email to security@fleetdm.com Join #fleet in osquery Slack
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/fleetdm/fleet/v4to a version that resolves this vulnerability.Fixed in 4.87.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.87.0 - Configuration
Restrict Observer, Observer+, and Technician roles (global or team-scoped) to fully trusted users until the patch is applied.
Fleet roles (Observer, Observer+, Technician) Role access policy = Restrict to fully trusted users - Operational
Rotate any credentials stored in team agent options (AWS keys, proxy passwords, session tokens) because those values were exposed.
- Operational
Rotate team enroll secrets for any team that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of GHSA-88p2-jj8w-j8qg?
The severity of GHSA-88p2-jj8w-j8qg is medium with a score of 6.5.
How do I fix GHSA-88p2-jj8w-j8qg?
To fix GHSA-88p2-jj8w-j8qg, upgrade to Fleet version 4.87.0 or later.
What category of vulnerability is GHSA-88p2-jj8w-j8qg classified under?
GHSA-88p2-jj8w-j8qg is classified as an information leak vulnerability.
What specific data is exposed by GHSA-88p2-jj8w-j8qg?
GHSA-88p2-jj8w-j8qg exposes team enroll secrets and full team configuration to observer-class users.
What type of software is affected by GHSA-88p2-jj8w-j8qg?
GHSA-88p2-jj8w-j8qg affects the software package go/github.com/fleetdm/fleet version 4.