Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xOThmLTJ4NHAtcHJqcs4AA_Wl

Exposure of debug and metrics endpoints in Pomerium

Impact

In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions.

Patches

v0.17.1

Workarounds

Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

https://github.com/pomerium/pomerium/pull/3212

For more information

If you have any questions or comments about this advisory:

• Open an issue in Pomerium
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-q98f-2x4p-prjr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOThmLTJ4NHAtcHJqcs4AA_Wl
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Identifiers: GHSA-q98f-2x4p-prjr, CVE-2022-24797
References:

• https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr
• https://nvd.nist.gov/vuln/detail/CVE-2022-24797
• https://github.com/pomerium/pomerium/pull/3212
• https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903
• https://pkg.go.dev/vuln/GO-2022-0413
• https://github.com/advisories/GHSA-q98f-2x4p-prjr

Repository: https://github.com/pomerium/pomerium
Blast Radius: 4.5

Affected Packages