Critical severity · published Mar 31, 2022
CVE-2022-24797
Pomerium is an identity-aware access proxy
9.1
CVSS
1.4%
EPSS
No
On KEV
Description
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Pomerium · Pomerium
0.16.0 before 0.17.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24797
Patch
https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903
Issue Tracking
https://github.com/pomerium/pomerium/pull/3212
Mitigation
https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr
More from Pomerium
9.8
CVE-2023-33189
Pomerium is an identity and context-aware access proxy
8.8
CVE-2021-41230
Pomerium is an open source identity-aware access proxy
8.6
CVE-2021-39206
Pomerium is an open source identity-aware access proxy
8.6
CVE-2021-39162
Pomerium is an open source identity-aware access proxy
7.5
CVE-2026-50285
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback