Medium severity · published Mar 5, 2021
CVE-2021-27099
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature,…
6.8
CVSS
0.7%
EPSS
No
On KEV
Description
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag value is the last element in the path. This issue has been fixed in SPIRE versions 0.11.3 and 0.12.1
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spire · Cncf
before 0.8.5; 0.9.0 before 0.9.4; 0.10.0 before 0.10.2; 0.11.0 before 0.11.3; 0.12.0 before 0.12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27099
Patch
https://github.com/spiffe/spire/security/advisories/GHSA-q7gm-mjrg-44h9
More from Spire
8.1
CVE-2021-27098
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result…