Executive brief
EasyBuild is a software build and installation framework used for managing complex scientific software stacks. When users enable debug logging and use GitHub integration features, their GitHub authentication tokens are written in plain text to temporary log files. If a user accidentally shares these debug logs or stores them insecurely, an attacker could obtain the token and access the user's GitHub account with their privileges.
Technical details
EasyBuild logs GitHub Personal Access Tokens (PATs) in plain text to debug log files when users invoke GitHub integration features (--from-pr, --new-pr, --merge-pr, --close-pr, etc.) with --debug enabled. The vulnerability is CWE-532 (sensitive information logging). The tokens appear in the top-level EasyBuild log file in /tmp (or a configured temp directory), though the files are initially restricted to the owner (mode 700). An attacker who gains access to these temporary files, or a user who inadvertently shares them, can extract and use the token. The fix, included in EasyBuild 4.1.2 (released March 16, 2020), masks the token before logging. Users should revoke exposed tokens via GitHub and regenerate new ones.
Affected products
- EasyBuild project EasyBuild all versions before 4.1.2
Timeline
- 2020-03-19: disclosed
- 2020-03-16: patched: Fix included in version 4.1.2