GitHub Advisoryadvisory · Go

GHSA-5v95-v8c8-3rh6 Privilege escalation in rbac

HIGH Published 2021-05-21 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-22538
Ecosystem
Go
Packages
github.com/google/exposure-notifications-verification-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276
Reviewed
2021-05-20

Affected packages

• Go github.com/google/exposure-notifications-verification-server: < 0.23.1 → fixed in 0.23.1

Description

Impact Using a carefully crafted request or malicious proxy, a user with `UserWrite` permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log. Patches The issue has been fixed in 0.24.0 and 0.23.1. Workarounds For users who are unable to upgrade, we recommend auditing users who have `UserWrite` permissions and regularly reviewing the Event Log for malicious activity. Kudos Thank you to Michael Mazzolini (Ethical Hacker at WHO) for finding and disclosing this vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-22538 A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References