CVE-2022-23551 – github.com/azure/aad-pod-identity

Package

Manager: go
Name: github.com/azure/aad-pod-identity
Vulnerable Version: >=0 <1.8.13

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00111 pctl0.30107

Details

AAD Pod Identity obtaining token with backslash ### Impact _What kind of vulnerability is it? Who is impacted?_ The [NMI](https://azure.github.io/aad-pod-identity/docs/concepts/nmi/) component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to [IMDS](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows) allowing a pod in the cluster to access identities that it shouldn't have access to. ### Patches _Has the problem been patched? What versions should users upgrade to?_ - We analyzed this bug and determined that we needed to fix it. This fix has been included in AAD Pod Identity release [v1.8.13](https://github.com/Azure/aad-pod-identity/releases/tag/v1.8.13) - If using the [AKS pod-managed identities add-on](https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity), no action is required. The clusters should now be running the `v1.8.13` release. ### For more information If you have any questions or comments about this advisory: Open an issue in [Azure/aad-pod-identity](https://github.com/Azure/aad-pod-identity)

Metadata

Created: 2022-12-21T18:48:22Z
Modified: 2022-12-21T19:26:02Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-p82q-rxpm-hjpc/GHSA-p82q-rxpm-hjpc.json
CWE IDs: ["CWE-863"]
Alternative ID: GHSA-p82q-rxpm-hjpc
Finding: F006
Auto approve: 1