Dapr 信息泄露漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. A security vulnerability exists in Dapr that stems from the disclosure of application tokens when using Dapr as a gRPC proxy for remote service calls. Affected products and versions:Dapr version 1.13.0, 1.13.1, 1.13.2...

Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

GHSA-284C-X8M7-9W5H Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

PT-2024-26387 · Dapr · Dapr

Name of the Vulnerable Software and Affected Versions: Dapr versions prior to 1.13.3 Description: Dapr sends the app token of the invoker app instead of the app token of the invoked app when using Dapr as a gRPC proxy for remote service invocation, causing a leak of the application token of the...

The vulnerability in the Dapr Dashboard’s web interface relates to the lack of authentication for critical functions, allowing attackers to influence the confidentiality of protected information.

The vulnerability in the Dapr Dashboard’s web interface is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to influence the confidentiality of the protected information...

Authentication Bypass

github.com/dapr/dapr is vulnerable to Authentication Bypass. The library allows bypassing of API token authentication, which enables an attacker to send unauthorized HTTP requests via the Dapr sidecar, only impacting users who rely on this authentication method...

CVE-2023-37918

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

Design/Logic Flaw

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

Dapr API token authentication bypass in HTTP endpoints

Summary A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10....

GHSA-59M6-82QM-VQGJ Dapr API token authentication bypass in HTTP endpoints

Summary A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10....

CVE-2023-37918 API token authentication bypass in HTTP endpoints in Dapr

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

CVE-2023-37918 API token authentication bypass in HTTP endpoints in Dapr

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

CVE-2023-37918

CVE-2023-37918 affects Dapr and describes an API-token authentication bypass in HTTP endpoints when API token authentication is enabled. The root cause involves health check endpoint allowlisting, where requests containing /healthz in the URL could bypass the dapr-api-token check and reach the Da...

CVE-2023-37918 API token authentication bypass in HTTP endpoints in Dapr

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

CVE-2023-37918

creationtimestamp| type| source ---|---|--- 2023-07-21 17:02:33+00:00| published-proof-of-concept| https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj...

Dapr 授权问题漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. Dapr suffers from an authorization issue vulnerability that stems from allowing bypassing API token authentication, where an attacker can authenticate calls from the application via a carefully crafted HTTP request...

avro vulnerable to denial of service via attacker-controlled parameter

Summary A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. Details The root cause of the issue is that avro uses part of the input to Unmarshal to...

GHSA-9X44-9PGQ-CF45 avro vulnerable to denial of service via attacker-controlled parameter

Summary A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. Details The root cause of the issue is that avro uses part of the input to Unmarshal to...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

Information Disclosure

Dapr dashboard is vulnerable to information disclosure. The vulnerability is due to the dashboard's access control not being properly configured, resulting in an attacker gaining access to obtain sensitive plaintext configuration of redis, mongodb, rabbitmq and other applications on the cloud...