GHSA-Q98F-2X4P-PRJR

Vulnerability from github – Published: 2024-09-06 21:01 – Updated: 2024-09-06 21:01
VLAI?
Summary
Exposure of debug and metrics endpoints in Pomerium
Details

Impact

In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions.

Patches

v0.17.1

Workarounds

Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

https://github.com/pomerium/pomerium/pull/3212

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pomerium/pomerium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24797"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-06T21:01:22Z",
    "nvd_published_at": "2022-03-31T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn distributed service mode, Pomerium\u0027s Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic.  This can leak potentially sensitive environmental information or lead to limited denial of service conditions.\n\n### Patches\nv0.17.1\n\n### Workarounds\nBlock access to `/debug` and `/metrics` paths on the authenticate service.  This can be done with any L7 proxy, including Pomerium\u0027s own proxy service.\n\n### References\nhttps://github.com/pomerium/pomerium/pull/3212\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Pomerium](https://github.com/pomerium/pomerium)\n* Email us at [security@pomerium.com](mailto:security@pomerium.com)",
  "id": "GHSA-q98f-2x4p-prjr",
  "modified": "2024-09-06T21:01:22Z",
  "published": "2024-09-06T21:01:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24797"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/pull/3212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pomerium/pomerium"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0413"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Exposure of debug and metrics endpoints in Pomerium"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.