CVE-2023-25570 Apollo has potential access control security issue in eureka
Attackers can bypass authentication to mock Apollo services if the config service is exposed to the internet without proper network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25570?
CVE-2023-25570 is a high-severity missing authorization vulnerability in apolloconfig apollo, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice. Login authentication for eureka was added in version 2.1.0. As a workaround, avoid exposing apollo-configservice to the internet.
Weakness: CWE-306
Which versions are affected by CVE-2023-25570?
2 open source packages ship an affected version, including com.ctrip.framework.apollo:apollo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.ctrip.framework.apollo:apollo Maven | All versions | 2.1.0 |
com.ctrip.framework.apollo:apollo Maven | All versions | 2.1.0 |
Products include Apolloconfig Apollo.
How do I fix CVE-2023-25570?
Upgrade com.ctrip.framework.apollo:apollo to 2.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-25570 being exploited?
There is no known exploitation of CVE-2023-25570 in the wild and no public exploit code.
Other vulnerabilities in apolloconfig apollo
Sources
Also known as GHSA-368x-wmmg-hq5c.