EdgeX Foundry up to 2.1.0 API Endpoint /api/v2/config information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in EdgeX Foundry up to 2.1.0. This affects an unknown function of the file /api/v2/config of the component API Endpoint. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2022-31066. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in EdgeX Foundry up to 2.1.0 and classified as problematic. This vulnerability affects an unknown part of the file /api/v2/config of the component API Endpoint. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to be kept in the EdgeX secret store and require authentication to access. This vulnerability bypasses the access controls on message bus credentials when running in security-enabled mode. (No credentials are required when running in security-disabled mode.) As a result, attackers could intercept data or inject fake data into the EdgeX message bus. Users should upgrade to EdgeXFoundry Kamakura release (2.2.0) or to the June 2022 EdgeXFoundry LTS Jakarta release (2.1.1) to receive a patch. More information about which go modules, docker containers, and snaps contain patches is available in the GitHub Security Advisory. There are currently no known workarounds for this issue.

The weakness was released 06/15/2022 as GHSA-g63h-q855-vp3q. The advisory is available at github.com. This vulnerability was named CVE-2022-31066 since 05/18/2022. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 2.1.1 or 2.2.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• EdgeX Foundry

Version

• 2.0
• 2.1.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion