Auth bypass in Azure Aad-Pod-Identity
CVE-2022-23551
aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.
Vulnerability class: Broken Access Control
EPSS: 0.007 (51.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L.
Affected products
- Azure Aad-pod-identity — versions < 1.8.13
- Microsoft Azure_ad_pod_identity
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-23551?
- CVE-2022-23551 is a medium-severity vulnerability in Azure Aad-Pod-Identity, classified under Incorrect Authorization. CVSS score: 5.3/10. Published 2022-12-21.
- How severe is CVE-2022-23551?
- Medium severity. CVSS v3 base score is 5.3 out of 10.