CVE-2023-37918

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.dapr.io/operations/security/api-token/	Product
https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a	Patch
https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:dapr::::::::
	cpe:2.3:a:linuxfoundation:dapr::::::::

History

No history.

Information

Published : 2023-07-21 21:15

Updated : 2023-07-31 17:30

NVD link : CVE-2023-37918

Mitre link : CVE-2023-37918

CVE.ORG link : CVE-2023-37918

JSON object : View

Products Affected

linuxfoundation

dapr

CWE

CWE-287

Improper Authentication

{"id": "CVE-2023-37918", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "published": "2023-07-21T21:15:11.657", "references": [{"url": "https://docs.dapr.io/operations/security/api-token/", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.\n"}], "lastModified": "2023-07-31T17:30:24.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:dapr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B132174A-53F6-44DE-9E4D-0EFA56B77D7E", "versionEndExcluding": "1.10.9"}, {"criteria": "cpe:2.3:a:linuxfoundation:dapr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD6E2E5B-FB46-4726-B10F-6FDE8F949D37", "versionEndExcluding": "1.11.2", "versionStartIncluding": "1.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}