CVE-2024-35223 json
Dapr API Token Exposure
published 2024-05-22 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1350 , GHSA-284c-x8m7-9w5h , GO-2024-2879
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.
Patch / fix
- go github.com/dapr/dapr 1.13.3
- linuxfoundation dapr 1.13.3
- github.com/dapr/dapr@e0591e4 commit
- github.com/dapr/dapr#7404 pull request
- github.com/dapr/dapr/releases/tag/v1.13.3 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/dapr/dapr | >=1.13.0, <1.13.3 |
1.13.3 |
Affected products
- dapr dapr
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/dapr/dapr/pull/7404
web, patch
-
github.com
/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c
web, patch
-
github.com
/dapr/dapr/security/advisories/GHSA-284c-x8m7-9w5h
web, advisory
-
github.com
/dapr/dapr/issues/7344
web, report
-
github.com
/dapr/dapr/releases/tag/v1.13.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-35223
advisory
-
github.com
/dapr/dapr
package
Sources
- CVE List CVE-2024-35223
- GitHub Advisory GHSA-284c-x8m7-9w5h
- NVD CVE-2024-35223
- OSV GO-2024-2879
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.