PT-2024-5622 · Linker · Linkerd
Panaji
·
Published
2024-07-15
·
Updated
2024-07-22
·
CVE-2024-40632
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Linkerd versions prior to edge-24.6.2
Description
The issue is related to insufficient server-side request validation in Linkerd, which can be exploited to trigger a denial-of-service (DoS) attack. An attacker could potentially make requests to localhost:4191/shutdown, causing the service to shut down. This can be achieved when the application being run by Linkerd is susceptible to Server-Side Request Forgery (SSRF). To mitigate this, Linkerd could introduce an optional environment variable to control a token that must be passed as a header, and reject shutdown requests that do not include this header.
Recommendations
For versions prior to edge-24.6.2, upgrade to release version edge-24.6.2 to address the issue. As a temporary workaround, consider restricting access to the
localhost:4191/shutdown endpoint until the upgrade is applied. Additionally, introducing an optional environment variable to control a token that must be passed as a header, and configuring Linkerd to reject shutdown requests that do not include this header, can help mitigate the risk of exploitation.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linkerd