Authentication Bypass and Credential Exposure in OpenCost

OpenCost versions prior to 1.121.0 are vulnerable to multiple authentication bypass flaws that facilitate credential access and administrative manipulation. The vulnerability stems from two primary failures in the application's authentication logic. First, the GET /helmValues endpoint does not perform authentication, which exposes the base64-encoded HELM_VALUES environment variable to unauthenticated attackers. This variable typically contains sensitive cloud provider credentials, such as API keys or service account details.

Second, the adminAuthMiddleware fails to enforce authentication requirements when the ADMIN_TOKEN environment variable is not set. This allows unauthenticated actors to interact with restricted administrative endpoints, specifically enabling the unauthorized modification of GCP service account keys via the POST /serviceKey endpoint. This could allow an attacker to redirect billing calls or escalate privileges within the compromised cloud environment. Defenders must prioritize upgrading to version 1.121.0 or ensuring that the ADMIN_TOKEN is strictly configured in all production deployments.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing or internally accessible OpenCost endpoints.
2. Attacker sends an unauthenticated GET request to the /helmValues endpoint.
3. The OpenCost server returns the contents of the HELM_VALUES environment variable, including sensitive cloud provider credentials.
4. Attacker decodes the base64-encoded response to retrieve the plain-text credentials.
5. Attacker attempts an unauthenticated POST request to the /serviceKey endpoint.
6. The server confirms the adminAuthMiddleware is inactive due to the absence of the ADMIN_TOKEN.
7. Attacker successfully submits a modified GCP service account key to the endpoint.
8. Attacker achieves the final objective of redirecting billing calls or maintaining persistence within the GCP environment.

Impact

The vulnerability exposes sensitive cloud provider credentials to unauthenticated attackers, potentially leading to unauthorized access to cloud resources. Successful exploitation of the service key modification allows attackers to redirect billing traffic, resulting in financial loss and potential data exfiltration paths through GCP service accounts. This issue affects any organization deploying OpenCost versions older than 1.121.0 without explicit ADMIN_TOKEN enforcement.

Recommendation

• Immediately upgrade all OpenCost deployments to version 1.121.0 or newer.
• If upgrading is not immediately possible, enforce a strong, non-default ADMIN_TOKEN across all OpenCost instances to prevent the adminAuthMiddleware from failing open.
• Deploy the provided Sigma rule to detect unauthenticated attempts to access sensitive endpoints.
• Audit cloud service account logs (GCP) for any suspicious modifications to service key objects, correlating these with source IP addresses associated with OpenCost instances.