Vulnerability · Published Jan 14, 2023 · Assigned by GitHub_M

CVE-2023-22495Izanami is vulnerable to Authorization Bypass

Critical 9.8

In plain English

A critical-severity authentication bypass in izanami from MAIF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 32.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.

Affected products (as reported)

Vendor	Product	Versions
MAIF	izanami	< 1.11.0

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c x_refsource_CONFIRM
https://github.com/MAIF/izanami/releases/tag/v1.11.0 x_refsource_MISC