SpiceDB binding metrics port to untrusted networks and can leak command-line flags

CVE-2023-29193

What is CVE-2023-29193?

SpiceDB, an open-source database system for managing security-critical application permissions, has a vulnerability that allows sensitive data exposure through the --grpc-preshared-key command-line flag. The /debug/pprof/cmdline endpoint, which normally serves for debugging, unintentionally reveals this sensitive key and other command-line flags when accessed. This issue could potentially affect users who expose their metrics service to untrusted networks while configuring the preshared key via command-line flags. It is essential for users to adopt recommended configurations, such as utilizing environment variables for sensitive keys or modifying the metrics service address to trusted networks to mitigate this risk. The vulnerability has been addressed in version 1.19.1 and users are encouraged to upgrade.

References