CVE-2022-23551 Explained : Impact and Mitigation

This article provides details about CVE-2022-23551, focusing on the security vulnerability related to AAD Pod Identity obtaining tokens with backslashes.

Understanding CVE-2022-23551

This CVE involves improper security token assignment and incorrect authorization in AAD Pod Identity, impacting Azure Active Directory identities assigned to Kubernetes applications.

What is CVE-2022-23551?

AAD Pod Identity, an Azure service, previously assigned identities to Kubernetes applications but faced a security flaw. An issue allowed pods to bypass validation and access unauthorized identities using backslashes in token requests.

The Impact of CVE-2022-23551

The vulnerability allowed unauthorized access to identities within Kubernetes clusters, compromising confidentiality and integrity. A pod could access identities it shouldn't have permissions for, potentially leading to data breaches.

Technical Details of CVE-2022-23551

This section delves into the vulnerability description, affected systems, versions, and exploitation mechanism.

Vulnerability Description

AAD Pod Identity's NMI component allowed backslash characters in token requests to bypass validation, granting unauthorized access to identities in Kubernetes clusters.

Affected Systems and Versions

Azure's aad-pod-identity versions prior to 1.8.13 were impacted by this vulnerability, exposing Kubernetes applications using this service to unauthorized access.

Exploitation Mechanism

By sending token requests with backslashes (e.g.,

/metadata/identity\oauth2\token/

), pods in the cluster could circumvent validation checks and access sensitive identities through IMDS.

Mitigation and Prevention

Here are the necessary steps to address the CVE-2022-23551 vulnerability and prevent future security risks.

Immediate Steps to Take

Update aad-pod-identity to version 1.8.13 to mitigate the vulnerability. For organizations using AKS pod-managed identities add-on, no action is required.

Long-Term Security Practices

Regularly update and monitor Azure services to ensure vulnerabilities are promptly addressed and security best practices are implemented.

Patching and Updates

Ensure that aad-pod-identity is updated to version 1.8.13 to patch the vulnerability and prevent unauthorized access to Kubernetes application identities.