GitStock

azure/aad-pod-identity · Security

AAD Pod Identity obtaining token with backslash

GHSA ID
GHSA-p82q-rxpm-hjpc
CVE ID
CVE-2022-23551
Severity
medium
Published
Updated
CVSS
5.3 · CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
CVSS v3
5.3 · CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

Description

Impact

What kind of vulnerability is it? Who is impacted? The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: /metadata/identity\oauth2\token/) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to.

Patches

Has the problem been patched? What versions should users upgrade to?

  • We analyzed this bug and determined that we needed to fix it. This fix has been included in AAD Pod Identity release v1.8.13
  • If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the v1.8.13 release.

For more information

If you have any questions or comments about this advisory:

Open an issue in Azure/aad-pod-identity

CWEs

  • CWE-863 · Incorrect Authorization

References