Authorization Bypass in Watch API of etcd: High-Risk Vulnerability
Summary
GHSA-xg4h-6gfc-h4m8: etcd: Watch API authorization bypass via open-ended range requests. Affects go.etcd.io/etcd/v3 across 3 version ranges.
< 3.5.33
>= 3.6.0, < 3.6.14
>= 3.7.0-alpha.0, < 3.7.1
Fixed in 3.5.33, 3.6.14 or 3.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
etcd is a distributed key-value store that provides a reliable way to store data across a cluster of machines. It is commonly used for shared configuration and service discovery. The package is designed to be secure and efficient, with features like role-based access control (RBAC) to manage permissions. However, a recent vulnerability has been identified that affects the Watch API, allowing unauthorized access to data.
Vulnerability Detail
The vulnerability arises from an authorization bypass in etcd's RBAC enforcement for the Watch API. Users granted READ permission on a specific key can exploit the Watch gRPC API with the 'clientv3.WithFromKey()' option. This allows them to receive watch events for all keys that are lexicographically greater than or equal to the key they have access to, rather than being restricted to just the key they were granted permission for. This issue only affects clusters with authentication enabled, as those without authentication already allow unrestricted read access. The potential ramifications include unauthorized data exposure, which could lead to sensitive information being accessed by users who should not have such permissions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.333.5.33go get go.etcd.io/etcd/v3@v3.5.33 -
>= 3.6.0, < 3.6.143.6.14go get go.etcd.io/etcd/v3@v3.6.14 -
>= 3.7.0-alpha.0, < 3.7.13.7.1go get go.etcd.io/etcd/v3@v3.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, consider the following mitigations: 1. Audit READ grants: Review and revoke any unnecessary READ permissions to limit exposure. 2. Restrict network access: Use firewall rules or network policies to limit which hosts can access etcd's client (gRPC) port, thereby reducing the risk of exploitation.
Conclusion
In summary, the etcd Watch API vulnerability presents a significant risk of unauthorized data access due to an authorization bypass. Users are strongly encouraged to upgrade to the patched versions to secure their systems. If upgrading is not feasible, implementing the suggested workarounds can help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for go.etcd.io/etcd/v3 →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Users of etcd with authentication enabled are affected, particularly those who have granted READ permissions on specific keys.
The vulnerability could lead to unauthorized access to sensitive data, as users can receive watch events for keys they should not have access to.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate upgrading is not possible, audit your READ grants and restrict network access to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for go.etcd.io/etcd/v3.
