CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
EPSS
Percentile
40.1%
What kind of vulnerability is it? Who is impacted?
The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: /metadata/identity\oauth2\token/
) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn’t have access to.
Has the problem been patched? What versions should users upgrade to?
v1.8.13
release.If you have any questions or comments about this advisory:
Open an issue in Azure/aad-pod-identity
Vendor | Product | Version | CPE |
---|---|---|---|
azure | aad-pod-identity | * | cpe:2.3:a:azure:aad-pod-identity:*:*:*:*:*:*:*:* |