CVE-2022-23551 (Go, published 2022-12-21T20:15Z)
Description: value: aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Azure/aad-pod-identity
Files changed:
pkg/nmi/server/server.go
pkg/nmi/server/server_test.go
Commit message: fix: add handler for invalid token requests (#1325)

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Vulnerable code:

Fixed code:
var (
	// invalidTokenPathMatcher matches the token path that is not supported by IMDS
	// this handler is configured right after the token path handler to block requests with
	// invalid token path instead of sending it to IMDS.
	// we don't have to handle case sensitivity for "/identity/" as that's rejected by IMDS
	invalidTokenPathMatcher = mux.MatcherFunc(func(req *http.Request, rm *mux.RouteMatch) bool {
		r := regexp.MustCompile("/(?i:metadata)/identity(.*?)oauth2(.*?)token") // #nosec
		return r.MatchString(req.URL.Path)
	})
)

	// Flow for the request is as follows:
	// 1. If the request is for token, then it will be handled by tokenHandler post validation.
	// 2. If the request is for token but the path is invalid, then it will be handled by invalidTokenPathHandler.
	// 3. If the request is for host token, then it will be handled by hostTokenHandler.
	// 4. If the request is for instance metadata
	//    4.1 If blockInstanceMetadata is set to true, then it will be handled by blockInstanceMetadataHandler (deny access to instance metadata).
	// 5. If the request is for any other path, it will be proxied to IMDS and the response will be returned to the caller.
	rtr.MatcherFunc(invalidTokenPathMatcher).HandlerFunc(invalidTokenPathHandler)
// invalidTokenPathHandler responds to invalid token requests with HTTP 400 Bad Request
func invalidTokenPathHandler(w http.ResponseWriter, r *http.Request) {
	http.Error(w, "Invalid request", http.StatusBadRequest)
}

		{
			name:               "invalid token request with \\oauth2",
			url:                `/metadata/identity\oauth2/token/`,
			expectedStatusCode: http.StatusOK,
			expectedBody:       "invalid_request_handler",
		},
		{
			name:               "invalid token request with \\token",
			url:                `/metadata/identity/oauth2\token/`,
			expectedStatusCode: http.StatusOK,
			expectedBody:       "invalid_request_handler",
		},
		{
			name:               "invalid token request with \\oauth2\\token",
			url:                `/metadata/identity\oauth2\token/`,
			expectedStatusCode: http.StatusOK,
			expectedBody:       "invalid_request_handler",
		},
		{
			name:               "invalid token request with mix of / and \\",
			url:                `/metadata/identity/\oauth2\token/`,
			expectedStatusCode: http.StatusOK,
			expectedBody:       "invalid_request_handler",
		},
		{
			name:               "invalid token request with multiple \\",
			url:                `/metadata/identity\\\oauth2\\token/`,
			expectedStatusCode: http.StatusOK,
			expectedBody:       "invalid_request_handler",
		},
			rtr.MatcherFunc(invalidTokenPathMatcher).HandlerFunc(testInvalidRequestHandler)

func testInvalidRequestHandler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintf(w, "invalid_request_handler\n")
}