CVE-2021-22538 Privilege escalation in RBAC system
An attacker with UserWrite permissions can escalate privileges by creating a higher-privileged user due to insufficient permission checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22538?
CVE-2021-22538 is a medium-severity vulnerability in Google LLC Exposure Notifications Verification Server, published on 31 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
Which versions are affected by CVE-2021-22538?
3 open source packages ship an affected version, including github.com/google/exposure-notifications-verification-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/google/exposure-notifications-verification-server Go | All versions | 0.23.1 |
github.com/google/exposure-notifications-verification-server Go | All versions | 0.23.1 |
github.com/google/exposure-notifications-verification-server Go | All versions | 0.23.1 |
Products include Google Exposure Notifications Verification Server.
How do I fix CVE-2021-22538?
Upgrade github.com/google/exposure-notifications-verification-server to 0.23.1 or later.
Is CVE-2021-22538 being exploited?
There is no known exploitation of CVE-2021-22538 in the wild and no public exploit code.
Sources
Also known as GHSA-5v95-v8c8-3rh6, GO-2022-0798.