Azure aad-pod-identity up to 1.8.12 NMI improper restriction of security token assignment

Summaryinfo

A vulnerability was found in Azure aad-pod-identity up to 1.8.12. It has been declared as problematic. This affects an unknown function of the component NMI. Such manipulation leads to improper restriction of security token assignment. This vulnerability is listed as CVE-2022-23551. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Azure aad-pod-identity up to 1.8.12. Affected by this issue is some unknown processing of the component NMI. The manipulation with an unknown input leads to a improper restriction of security token assignment vulnerability. Using CWE to declare the problem leads to CWE-1259. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected. Impacted is confidentiality, integrity, and availability. CVE summarizes:

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.

The weakness was presented 12/21/2022 as GHSA-p82q-rxpm-hjpc. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2022-23551 since 01/19/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1134.001.

Upgrading to version 1.8.13 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 7e01970391bde6c360d077066ca17d059204cb5d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Azure

Name

• aad-pod-identity

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12

License

• open-source

Website

• Product: https://github.com/Azure/aad-pod-identity/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion