etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch.
Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
etcd-io:etcd
References 8
https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
security-advisories@github.com
https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed
security-advisories@github.com
https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
security-advisories@github.com
https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
security-advisories@github.com
https://github.com/etcd-io/etcd/releases/tag/v3.5.33
security-advisories@github.com
https://github.com/etcd-io/etcd/releases/tag/v3.6.14
security-advisories@github.com
https://github.com/etcd-io/etcd/releases/tag/v3.7.1
security-advisories@github.com
https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
security-advisories@github.com