CVE-2021-41230 OIDC claims not updated from Identity Provider in Pomerium
Pomerium fails to update OIDC claims after login, allowing users to bypass authorization policies if their identity provider claims change.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41230?
CVE-2021-41230 is a medium-severity missing authorization vulnerability in pomerium, published on 5 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
Weakness: CWE-863
Which versions are affected by CVE-2021-41230?
3 open source packages ship an affected version, including github.com/pomerium/pomerium. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pomerium/pomerium Go | All versions | 0.15.6 |
github.com/pomerium/pomerium Go | From 0.14.0 | 0.15.6 |
github.com/pomerium/pomerium Go | From 0.14.0 | 0.15.6 |
Products include Pomerium Pomerium.
How do I fix CVE-2021-41230?
Upgrade github.com/pomerium/pomerium to 0.15.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-41230 being exploited?
There is no known exploitation of CVE-2021-41230 in the wild and no public exploit code.
Other vulnerabilities in pomerium
- CVE-2023-33189 Incorrect Authorization with specially crafted requests
- CVE-2022-24797 Exposure of Sensitive Information in Pomerium
- CVE-2021-29651 JWT leak via Open Redirect in Programmatic access
- CVE-2021-29652 pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Sources
Also known as GHSA-j6wp-3859-vxfg, GO-2021-0258.