PT-2023-26185 · Dapr · Dapr

Italypaleale · Published 2023-07-21 · Updated 2024-08-20 · CVE-2023-37918

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dapr versions prior to 1.10.9 Dapr versions prior to 1.11.2

Description A vulnerability has been found in Dapr that allows bypassing API token authentication with a well-crafted HTTP request. This issue impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the dapr-api-token in the request is invalid or missing. The vulnerability is related to the allowlisting of healthcheck endpoints, which permitted all requests whose URL contains /healthz to bypass the API token authentication check.

Recommendations For Dapr versions prior to 1.10.9, upgrade to version 1.10.9 or later. For Dapr versions prior to 1.11.2, upgrade to version 1.11.2 or later. As a temporary workaround, consider restricting access to the /v1.0/healthz and /v1.0/healthz/outbound HTTP APIs to minimize the risk of exploitation. Avoid using URLs that contain /healthz in the query string until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

Related Identifiers

CVE-2023-37918

GHSA-59M6-82QM-VQGJ

GO-2023-1955

Affected Products

Dapr

References · 12

• 🔥 https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37918.json · Exploit
• https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a · Patch
• https://osv.dev/vulnerability/GHSA-59m6-82qm-vqgj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37918 · Security Note
• https://osv.dev/vulnerability/GO-2023-1955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37918 · Vendor Advisory
• https://github.com/dapr/dapr · Note
• https://github.com/dapr/dapr/commit/99d6799c97b79397443c8c96737c9b893126a1ae · Note
• https://t.me/cvenotify/54916 · Telegram Post
• https://docs.dapr.io/operations/security/api-token · Note
• https://t.me/cvenotify/55583 · Telegram Post