CVE-2023-33189
📋 TL;DR
CVE-2023-33189 is an authorization bypass vulnerability in Pomerium identity-aware access proxy. Attackers can craft requests to bypass authorization controls and access protected resources. All Pomerium deployments running vulnerable versions are affected.
💻 Affected Systems
- Pomerium
📦 What is this software?
Pomerium by Pomerium
Pomerium by Pomerium
Pomerium by Pomerium
Pomerium by Pomerium
Pomerium by Pomerium
Pomerium by Pomerium
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of protected backend services, allowing unauthorized access to sensitive data and systems behind Pomerium.
Likely Case
Unauthorized access to specific protected resources based on attacker's ability to craft malicious requests.
If Mitigated
Limited impact if network segmentation, additional authentication layers, or strict access controls are in place.
🎯 Exploit Status
Exploitation requires understanding of Pomerium's authorization logic and ability to craft specific requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, or 0.22.2 depending on your current version
Vendor Advisory: https://github.com/pomerium/pomerium/security/advisories
Restart Required: Yes
Instructions:
1. Identify current Pomerium version. 2. Upgrade to appropriate patched version based on your current major version. 3. Restart Pomerium service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Network segmentation
allImplement strict network segmentation to limit access to backend services even if Pomerium is bypassed
Additional authentication layer
allAdd secondary authentication/authorization layer for critical resources
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure of backend services
- Deploy additional WAF or API gateway with authorization validation
🔍 How to Verify
Check if Vulnerable:
Check Pomerium version using 'pomerium --version' or container image tagCheck Version:
pomerium --versionVerify Fix Applied:
Confirm version is 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, or 0.22.2 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual authorization patterns
- Requests bypassing expected policy rules
- Access to resources without proper authentication logs
Network Indicators:
- Direct access attempts to backend services bypassing Pomerium
- Unusual request patterns to Pomerium endpoints
SIEM Query:
source="pomerium" AND (auth_result="denied" OR policy_violation="true") | stats count by user, resource🔗 References
- https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
- https://github.com/pomerium/pomerium/releases/tag/v0.17.4
- https://github.com/pomerium/pomerium/releases/tag/v0.18.1
- https://github.com/pomerium/pomerium/releases/tag/v0.19.2
- https://github.com/pomerium/pomerium/releases/tag/v0.20.1
- https://github.com/pomerium/pomerium/releases/tag/v0.21.4
- https://github.com/pomerium/pomerium/releases/tag/v0.22.2
- https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
- https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
- https://github.com/pomerium/pomerium/releases/tag/v0.17.4
- https://github.com/pomerium/pomerium/releases/tag/v0.18.1
- https://github.com/pomerium/pomerium/releases/tag/v0.19.2
- https://github.com/pomerium/pomerium/releases/tag/v0.20.1
- https://github.com/pomerium/pomerium/releases/tag/v0.21.4
- https://github.com/pomerium/pomerium/releases/tag/v0.22.2
- https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
