CVE-2023-33189 Incorrect Authorization with specially crafted requests
Attackers can bypass authorization controls in Pomerium using specially crafted requests, gaining unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33189?
CVE-2023-33189 is a critical missing authorization vulnerability in pomerium, published on 30 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
Weakness: CWE-285
Which versions are affected by CVE-2023-33189?
13 open source packages ship an affected version, including github.com/pomerium/pomerium. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pomerium/pomerium Go | All versions | 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, 0.22.2 |
github.com/pomerium/pomerium Go | All versions | 0.17.4 |
github.com/pomerium/pomerium Go | All versions | 0.17.4 |
github.com/pomerium/pomerium Go | From 0.18.0 | 0.18.1 |
github.com/pomerium/pomerium Go | From 0.18.0 | 0.18.1 |
github.com/pomerium/pomerium Go | From 0.19.0 | 0.19.2 |
7 more packages
github.com/pomerium/pomerium Go | From 0.19.0 | 0.19.2 |
github.com/pomerium/pomerium Go | From 0.20.0 | 0.20.1 |
github.com/pomerium/pomerium Go | From 0.20.0 | 0.20.1 |
github.com/pomerium/pomerium Go | From 0.21.0 | 0.21.4 |
github.com/pomerium/pomerium Go | From 0.21.0 | 0.21.4 |
github.com/pomerium/pomerium Go | From 0.22.0 | 0.22.2 |
github.com/pomerium/pomerium Go | From 0.22.0 | 0.22.2 |
Products include Pomerium Pomerium.
How do I fix CVE-2023-33189?
Upgrade github.com/pomerium/pomerium to a fixed version for your release line: 0.17.4, 0.18.1, 0.19.2 or 0.20.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-33189 being exploited?
There is no known exploitation of CVE-2023-33189 in the wild and no public exploit code.
Other vulnerabilities in pomerium
- CVE-2022-24797 Exposure of Sensitive Information in Pomerium
- CVE-2021-29651 JWT leak via Open Redirect in Programmatic access
- CVE-2021-29652 pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
- CVE-2021-41230 OIDC claims not updated from Identity Provider in Pomerium
Sources
Also known as GHSA-pvrc-wvj2-f59p, GO-2023-1800.