Auth bypass in Dapr
CVE-2023-37918
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.014 (71.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 71.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Dapr — versions < 1.11.2
- Linuxfoundation Dapr
Weakness classification (CWE)
References
- github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj (Exploit, Vendor Advisory)
- github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a (Patch)
- docs.dapr.io/operations/security/api-token/ (Product)
Frequently asked questions
- What is CVE-2023-37918?
- CVE-2023-37918 is a medium-severity vulnerability in Dapr, classified under Improper Authentication. CVSS score: 6.8/10. Published 2023-07-21.
- How severe is CVE-2023-37918?
- Medium severity. CVSS v3 base score is 6.8 out of 10.