GHSA-h8g9-6gvh-5mrc etcd vulnerable to TOCTOU of gateway endpoint authentication

Not scored Published 6 Oct 2022

An attacker can bypass authentication in etcd gateway if endpoint settings change after initial DNS-based validation, requiring specific gateway configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-h8g9-6gvh-5mrc?

GHSA-h8g9-6gvh-5mrc is an authentication bypass vulnerability in go.etcd.io/etcd/v3, published on 6 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability type

Authentication

Workarounds

Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.

Detail

The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.

References

Find out more on this vulnerability in the security audit report

For more information

If you have any questions or comments about this advisory:

Contact the etcd security committee

Which versions are affected by GHSA-h8g9-6gvh-5mrc?

4 open source packages ship an affected version, including go.etcd.io/etcd/v3.

Package	Affected	Fixed in
`go.etcd.io/etcd/v3` Go	All versions	`3.3.23`
`go.etcd.io/etcd/v3` Go	All versions	`3.3.23`
`go.etcd.io/etcd/v3` Go	From `3.4.0`	`3.4.10`
`go.etcd.io/etcd/v3` Go	From `3.4.0`	`3.4.10`

How do I fix GHSA-h8g9-6gvh-5mrc?

Upgrade go.etcd.io/etcd/v3 to a fixed version for your release line: 3.3.23 or 3.4.10.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is GHSA-h8g9-6gvh-5mrc being exploited?

There is no known exploitation of GHSA-h8g9-6gvh-5mrc in the wild and no public exploit code.