A vulnerability in GLib's D-Bus client-side DBUS_COOKIE_SHA1 SASL authentication mechanism arises from improper validation of the cookie_context parameter received from the server. This allows a malicious D-Bus server to include path traversal sequences in cookie_context, causing the client to read arbitrary files on the filesystem. The attacker can exfiltrate sensitive secrets such as SSH keys or API tokens by guessing file contents and verifying them against generated hashes. Exploitation requires the attacker to be able to perform a man-in-the-middle attack or control a malicious server the client connects to, and involves an oracle attack, increasing complexity. Red Hat's advisory rates the vulnerability as moderate severity with a CVSS 3.1 score of 5.9 (Network attack vector, high attack complexity, no privileges or user interaction required, high confidentiality impact).

Successful exploitation allows an attacker to read arbitrary files on the victim's filesystem, potentially exposing sensitive secrets like SSH keys or API tokens. This compromises confidentiality but does not affect integrity or availability. The attack complexity is high due to the need for man-in-the-middle positioning or malicious server control and the requirement of an oracle attack to extract data.

Red Hat advises ensuring that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle attacks. Additionally, configuring the D-Bus connection to require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will fully mitigate the vulnerability. Red Hat has released security updates that fix this issue; applying these patches is recommended.