PT-2022-15054 · Unknown · Wasmcloud Host Runtime

Brooksmtownsend + 1 · Published 2022-01-21 · Updated 2023-07-24 · CVE-2022-21707

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions wasmCloud Host Runtime versions prior to 0.52.2

Description The issue affects the security model of actors in the wasmCloud Host Runtime, allowing them to bypass capability authorization. Normally, actors are required to declare their capabilities for inbound invocations. However, due to this problem, actor capability claims are not verified upon receiving invocations, which compromises the security model. This enables actors to receive unauthorized invocations from linked capability providers.

Recommendations For versions prior to 0.52.2, upgrade to version 0.52.2 or greater as soon as possible, as there is no workaround available.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2022-21707

GHSA-2CMX-RR54-88G5

Affected Products

Wasmcloud Host Runtime

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21707.json · Exploit
• https://github.com/wasmCloud/wasmcloud-otp/commit/fd07262074b98b06106a31fd1957dc2319d438a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21707 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21707 · Vendor Advisory
• https://github.com/wasmCloud/wasmcloud-otp/security/advisories/GHSA-2cmx-rr54-88g5 · Note
• https://t.me/cvenotify/55028 · Telegram Post