github - ghsa-q98f-2x4p-prjr

ghsa-q98f-2x4p-prjr

Vulnerability from github

Published

2024-09-06 21:01

Modified

2024-09-06 21:01

Severity

6.5 (Medium) - CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
6.9 (Medium) - CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

Exposure of debug and metrics endpoints in Pomerium

Details

Impact

In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions.

Patches

v0.17.1

Workarounds

Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

https://github.com/pomerium/pomerium/pull/3212

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pomerium/pomerium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24797"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-06T21:01:22Z",
    "nvd_published_at": "2022-03-31T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic.  This can leak potentially sensitive environmental information or lead to limited denial of service conditions.\n\n### Patches\nv0.17.1\n\n### Workarounds\nBlock access to `/debug` and `/metrics` paths on the authenticate service.  This can be done with any L7 proxy, including Pomerium\u0027s own proxy service.\n\n### References\nhttps://github.com/pomerium/pomerium/pull/3212\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Pomerium](https://github.com/pomerium/pomerium)\n* Email us at [security@pomerium.com](mailto:security@pomerium.com)",
  "id": "GHSA-q98f-2x4p-prjr",
  "modified": "2024-09-06T21:01:22Z",
  "published": "2024-09-06T21:01:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24797"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/pull/3212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pomerium/pomerium"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0413"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Exposure of debug and metrics endpoints in Pomerium"
}

cve-2022-24797

Vulnerability from cvelistv5

Published

2022-03-31 22:40

Modified

2024-08-03 04:20

Severity

6.5 (Medium) - cvssV3_1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

Exposure of Sensitive Information in Pomerium

References

URL	Tags
https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr	x_refsource_CONFIRM
https://github.com/pomerium/pomerium/pull/3212	x_refsource_MISC
https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903	x_refsource_MISC

Impacted products

Vendor	Product
pomerium	pomerium

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/pull/3212"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pomerium",
          "vendor": "pomerium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= v0.16.0, \u003c v0.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium\u0027s own proxy service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-31T22:40:12",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pomerium/pomerium/pull/3212"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
        }
      ],
      "source": {
        "advisory": "GHSA-q98f-2x4p-prjr",
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of Sensitive Information in Pomerium",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24797",
          "STATE": "PUBLIC",
          "TITLE": "Exposure of Sensitive Information in Pomerium"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pomerium",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= v0.16.0, \u003c v0.17.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "pomerium"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium\u0027s own proxy service."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr",
              "refsource": "CONFIRM",
              "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
            },
            {
              "name": "https://github.com/pomerium/pomerium/pull/3212",
              "refsource": "MISC",
              "url": "https://github.com/pomerium/pomerium/pull/3212"
            },
            {
              "name": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903",
              "refsource": "MISC",
              "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-q98f-2x4p-prjr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24797",
    "datePublished": "2022-03-31T22:40:12",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-08-03T04:20:50.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

ghsa-q98f-2x4p-prjr

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

cve-2022-24797

Vulnerability from cvelistv5

Tags