CVE-2023-37918 (GCVE-0-2023-37918)
Vulnerability from cvelistv5
Published
2023-07-21 20:08
Modified
2024-10-10 18:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:23:27.692Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj"
},
{
"name": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a"
},
{
"name": "https://docs.dapr.io/operations/security/api-token/",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.dapr.io/operations/security/api-token/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dapr:dapr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dapr",
"vendor": "dapr",
"versions": [
{
"lessThan": "1.11.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37918",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T18:20:55.913377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T18:40:09.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dapr",
"vendor": "dapr",
"versions": [
{
"status": "affected",
"version": "\u003c 1.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-21T20:08:00.768Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj"
},
{
"name": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a"
},
{
"name": "https://docs.dapr.io/operations/security/api-token/",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.dapr.io/operations/security/api-token/"
}
],
"source": {
"advisory": "GHSA-59m6-82qm-vqgj",
"discovery": "UNKNOWN"
},
"title": "API token authentication bypass in HTTP endpoints in Dapr"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-37918",
"datePublished": "2023-07-21T20:08:00.768Z",
"dateReserved": "2023-07-10T17:51:29.612Z",
"dateUpdated": "2024-10-10T18:40:09.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"API token authentication bypass in HTTP endpoints in Dapr\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-287\", \"lang\": \"en\", \"description\": \"CWE-287: Improper Authentication\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.8, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj\"}, {\"name\": \"https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a\"}, {\"name\": \"https://docs.dapr.io/operations/security/api-token/\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://docs.dapr.io/operations/security/api-token/\"}], \"affected\": [{\"vendor\": \"dapr\", \"product\": \"dapr\", \"versions\": [{\"version\": \"\u003c 1.11.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-07-21T20:08:00.768Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.\\n\"}], \"source\": {\"advisory\": \"GHSA-59m6-82qm-vqgj\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T17:23:27.692Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"name\": \"https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj\"}, {\"name\": \"https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a\"}, {\"name\": \"https://docs.dapr.io/operations/security/api-token/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://docs.dapr.io/operations/security/api-token/\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-37918\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-10T18:20:55.913377Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:dapr:dapr:*:*:*:*:*:*:*:*\"], \"vendor\": \"dapr\", \"product\": \"dapr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.11.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-10T18:40:02.992Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2023-37918\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2023-07-10T17:51:29.612Z\", \"datePublished\": \"2023-07-21T20:08:00.768Z\", \"dateUpdated\": \"2024-10-10T18:40:09.738Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…