github - ghsa-q98f-2x4p-prjr

ghsa-q98f-2x4p-prjr

Vulnerability from github

Published

2024-09-06 21:01

Modified

2024-09-06 21:01

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

Exposure of debug and metrics endpoints in Pomerium

Details

Impact

In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions.

Patches

v0.17.1

Workarounds

Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

https://github.com/pomerium/pomerium/pull/3212

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pomerium/pomerium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24797"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-06T21:01:22Z",
    "nvd_published_at": "2022-03-31T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic.  This can leak potentially sensitive environmental information or lead to limited denial of service conditions.\n\n### Patches\nv0.17.1\n\n### Workarounds\nBlock access to `/debug` and `/metrics` paths on the authenticate service.  This can be done with any L7 proxy, including Pomerium\u0027s own proxy service.\n\n### References\nhttps://github.com/pomerium/pomerium/pull/3212\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Pomerium](https://github.com/pomerium/pomerium)\n* Email us at [security@pomerium.com](mailto:security@pomerium.com)",
  "id": "GHSA-q98f-2x4p-prjr",
  "modified": "2024-09-06T21:01:22Z",
  "published": "2024-09-06T21:01:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24797"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/pull/3212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pomerium/pomerium"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0413"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Exposure of debug and metrics endpoints in Pomerium"
}

cve-2022-24797

Vulnerability from cvelistv5

Published

2022-03-31 22:40

Modified

2024-08-03 04:20

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

Exposure of Sensitive Information in Pomerium

References

▼	URL	Tags
	https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr	x_refsource_CONFIRM
	https://github.com/pomerium/pomerium/pull/3212	x_refsource_MISC
	https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903	x_refsource_MISC

Impacted products

▼	Vendor	Product
	pomerium	pomerium

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/pull/3212"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pomerium",
          "vendor": "pomerium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= v0.16.0, \u003c v0.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium\u0027s own proxy service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-31T22:40:12",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pomerium/pomerium/pull/3212"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
        }
      ],
      "source": {
        "advisory": "GHSA-q98f-2x4p-prjr",
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of Sensitive Information in Pomerium",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24797",
          "STATE": "PUBLIC",
          "TITLE": "Exposure of Sensitive Information in Pomerium"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pomerium",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= v0.16.0, \u003c v0.17.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "pomerium"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium\u0027s own proxy service."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr",
              "refsource": "CONFIRM",
              "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
            },
            {
              "name": "https://github.com/pomerium/pomerium/pull/3212",
              "refsource": "MISC",
              "url": "https://github.com/pomerium/pomerium/pull/3212"
            },
            {
              "name": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903",
              "refsource": "MISC",
              "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-q98f-2x4p-prjr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24797",
    "datePublished": "2022-03-31T22:40:12",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-08-03T04:20:50.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-q98f-2x4p-prjr

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

cve-2022-24797

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature