GitHub Advisoryadvisory · Go

GHSA-p82q-rxpm-hjpc AAD Pod Identity obtaining token with backslash

MEDIUM Published 2022-12-21 Modified 2022-12-21 Official page ↗
Aliases
CVE-2022-23551
Ecosystem
Go
Packages
github.com/Azure/aad-pod-identity
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
Weaknesses
CWE-863
Reviewed
2022-12-21

Affected packages

• Go github.com/Azure/aad-pod-identity: < 1.8.13 → fixed in 1.8.13

Description

Impact _What kind of vulnerability is it? Who is impacted?_ The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. Patches _Has the problem been patched? What versions should users upgrade to?_ • We analyzed this bug and determined that we needed to fix it. This fix has been included in AAD Pod Identity release v1.8.13 • If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the `v1.8.13` release. For more information If you have any questions or comments about this advisory: Open an issue in Azure/aad-pod-identity

Related

Alias · CVE (1)

  • CVE-2022-23551 aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References