CVE-2024-40632 Linkerd potential access to the shutdown endpoint
An attacker can exploit SSRF in the application to trigger a denial-of-service attack on Linkerd by accessing its shutdown endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40632?
CVE-2024-40632 is a low-severity server-side request forgery vulnerability in linkerd2, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2024-40632?
1 open source package ship an affected version, including github.com/linkerd/linkerd2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/linkerd/linkerd2 Go | All versions | 0.5.1-0.20240614165515-35fb2d6d11ef |
How do I fix CVE-2024-40632?
Upgrade github.com/linkerd/linkerd2 to 0.5.1-0.20240614165515-35fb2d6d11ef or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-40632 being exploited?
There is no known exploitation of CVE-2024-40632 in the wild and no public exploit code.
Sources
Also known as GHSA-6v94-gj6x-jqj7, GO-2024-2984.