CVE-2022-24797 Exposure of Sensitive Information in Pomerium

What is CVE-2022-24797?

CVE-2022-24797 is a medium-severity vulnerability in pomerium, published on 31 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

Weakness: CWE-200

Which versions are affected by CVE-2022-24797?

3 open source packages ship an affected version, including github.com/pomerium/pomerium. It affects 1 product.

Products include Pomerium Pomerium.

How do I fix CVE-2022-24797?

Upgrade github.com/pomerium/pomerium to 0.17.1 or later.

Is CVE-2022-24797 being exploited?

There is no known exploitation of CVE-2022-24797 in the wild and no public exploit code.

Other vulnerabilities in pomerium

• CVE-2023-33189 Incorrect Authorization with specially crafted requests Critical 10.0
• CVE-2021-29651 JWT leak via Open Redirect in Programmatic access Medium 6.1
• CVE-2021-29652 pomerium_signature is not verified in middleware in github.com/pomerium/pomerium Medium 6.1
• CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response Medium 5.7
• CVE-2021-41230 OIDC claims not updated from Identity Provider in Pomerium Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q98f-2x4p-prjr, GO-2022-0413.