x/vulndb: potential Go vuln in github.com/dapr/dapr: CVE-2024-35223

[GoVulnBot]

CVE-2024-35223 references github.com/dapr/dapr, which may be a Go module.

Description:
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-35223
• JSON: https://github.com/CVEProject/cvelist/tree/e71cdd252f9325d7309fbdd1fe9d5c36a38c704f/2024/35xxx/CVE-2024-35223.json
• advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-35223
• fix: dapr/dapr@e0591e4
• fix: append app token to outgoing calls, if it is provided dapr/dapr#7404
• report: dapr-api-token passed back to the application 'as-is' when proxying dapr/dapr#7344
• web: https://github.com/dapr/dapr/releases/tag/v1.13.3
• web: GHSA-284c-x8m7-9w5h
• Imported by: https://pkg.go.dev/github.com/dapr/dapr?tab=importedby

Cross references:

• Module github.com/dapr/dapr appears in issue x/vulndb: potential Go vuln in github.com/dapr/dapr: GHSA-59m6-82qm-vqgj #1955 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/dapr/dapr
      vulnerable_at: 1.13.3
      packages:
        - package: dapr
summary: CVE-2024-35223 in github.com/dapr/dapr
cves:
    - CVE-2024-35223
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-35223
    - fix: https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c
    - fix: https://github.com/dapr/dapr/pull/7404
    - report: https://github.com/dapr/dapr/issues/7344
    - web: https://github.com/dapr/dapr/releases/tag/v1.13.3
    - web: https://github.com/dapr/dapr/security/advisories/GHSA-284c-x8m7-9w5h
source:
    id: CVE-2024-35223
    created: 2024-05-23T10:01:24.895123145Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/588295 mentions this issue: data/reports: add GO-2024-2879